Nathan Esquenazi 0875dddbff fix(security): sandbox _serve_static() to prevent path traversal ... Resolved path was not checked against the static/ directory, allowing GET /static/../../../../etc/passwd to serve arbitrary files. Fix: resolve the path and call relative_to(static_root) before serving. Returns 404 for any path that escapes the static/ directory. fix(css): add !important to three dead mobile overrides in @media(640px) Three @media(max-width:640px) rules added by the mobile responsive PR were silently overridden by later bare rules in the same stylesheet: .composer-wrap padding (overridden by line 347) .suggestion-grid max-width (overridden by line 364) .tool-card margin-left (overridden by line 460) Fix: add !important to these three declarations so the mobile overrides actually fire on narrow screens. Tests: 224 passed, 0 failed.		2026-04-02 06:39:27 +00:00
..
boot.js	fix(frontend): use URL origin for fetch/EventSource to support reverse proxy auth	2026-03-31 15:00:38 +00:00
index.html	fix(css): mobile responsive layout and dvh viewport fix	2026-03-31 15:00:50 +00:00
messages.js	fix: add withCredentials to EventSource for reverse proxy auth	2026-04-01 22:53:50 -07:00
panels.js	Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish	2026-03-31 07:02:47 +00:00
sessions.js	Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish	2026-03-31 07:02:47 +00:00
style.css	fix(security): sandbox _serve_static() to prevent path traversal	2026-04-02 06:39:27 +00:00
ui.js	fix(frontend): use URL origin for fetch/EventSource to support reverse proxy auth	2026-03-31 15:00:38 +00:00
workspace.js	fix(frontend): use URL origin for fetch/EventSource to support reverse proxy auth	2026-03-31 15:00:38 +00:00