MechaCat02 44641473ea fix(quota): stop /me/quota leaking raw disk to guests ...

The per-user quota widget was shown to everyone and the /me/quota payload returned
free_disk_bytes (raw server free space) and active_uploaders to any authenticated
guest. Gate the widget to staff (host/admin) on the upload and account pages, and zero
the server-wide telemetry fields for non-staff in the handler. Guests still get their
own used/limit so enforcement stays transparent.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-19 15:22:03 +02:00

..

migrations

fix(diashow): open SSE on mount; raise upload rate 10→100/hour

2026-07-18 17:29:08 +02:00

scripts

chore(deploy): expose the export rebuild hatch in the UI; rehearse migration 014

2026-07-14 21:09:53 +02:00

src

fix(quota): stop /me/quota leaking raw disk to guests

2026-07-19 15:22:03 +02:00

static/export-viewer

feat(export): single-file offline keepsake viewer + guest download

2026-07-18 17:28:54 +02:00

tests

style(backend): rustfmt the whole tree; gate cargo fmt --check in CI

2026-07-15 19:52:17 +02:00

Cargo.lock

backend(infra): shared config helper, startup recovery, periodic maintenance

2026-05-16 14:31:41 +02:00

Cargo.toml

backend(infra): shared config helper, startup recovery, periodic maintenance

2026-05-16 14:31:41 +02:00

Dockerfile

fix(review-2): critical — repair comment posting + close export data leak

2026-07-02 22:19:32 +02:00