7e523392c0
- Add requirePin() check on add/update/delete endpoints (closes PIN bypass vulnerability) - Restrict CORS to specific allowed origins only - Add input length limits to sanitize() function - Frontend now sends currentPin with all write requests - Deploy script copies data/index.php to block directory listing 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
28 lines
650 B
Bash
Executable File
28 lines
650 B
Bash
Executable File
#!/bin/sh
|
|
USER=admin
|
|
HOST=social
|
|
DIR=/var/www/my_webapp__2/www
|
|
|
|
# Deploy code files
|
|
rsync -avz --no-t --no-p --delete \
|
|
--exclude 'data/' \
|
|
index.html api.php containers.json og-image.png ${HOST}:${DIR}
|
|
|
|
# Deploy data directory protection
|
|
scp data/index.php ${HOST}:${DIR}/data/index.php 2>/dev/null || true
|
|
|
|
# Handle data files
|
|
if [ "$1" = "--reset-data" ]; then
|
|
echo "Pushing local data to server..."
|
|
rsync -avz --no-t --no-p \
|
|
data/ ${HOST}:${DIR}/data/
|
|
else
|
|
echo "Pulling data from server..."
|
|
mkdir -p data
|
|
rsync -avz --no-t --no-p \
|
|
--exclude 'pin.txt' \
|
|
${HOST}:${DIR}/data/ data/
|
|
fi
|
|
|
|
exit 0
|