mirror of
https://github.com/wekan/wekan.git
synced 2026-11-06 18:45:11 -05:00
Lauri Ojansivu
6678c92e08
Record more runtime rejections into the eventlog (Admin Panel Problems): - fileValidation.js: log every upload rejection (dangerous MIME content -> xss.mime, mime not on the allow-list -> file.mime, over size limit -> file.size). - metrics.js: log spoofing.xff when a /metrics request carrying an X-Forwarded-For header is denied (likely forged-whitelisted-IP attempt). - export.js: log authz.export at all four export-authorization denial paths. All calls are best-effort/guarded (server-only require, try/catch) so logging never breaks the guard. Source-guard tests added.