instbyte 1.6.2 → 1.6.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instbyte",
-  "version": "1.6.2",
+  "version": "1.6.3",
   "description": "A self-hosted LAN sharing utility for fast, frictionless file, link, and snippet exchange across devices — no cloud required.",
   "main": "server/server.js",
   "bin": {
@@ -26,7 +26,7 @@
     "socket-io",
     "sqlite"
   ],
-  "author": "your name",
+  "author": "Mohit Gauniyal",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -39,9 +39,10 @@
     "cookie-parser": "^1.4.6",
     "express": "^4.18.2",
     "express-rate-limit": "^7.1.5",
+    "helmet": "^8.1.0",
     "multer": "^2.0.2",
     "sharp": "^0.33.2",
     "socket.io": "^4.6.1",
     "sqlite3": "^5.1.6"
   }
-}
+}

package/server/server.js

@@ -4,6 +4,7 @@ const os = require("os");
 const net = require("net");
 const cookieParser = require("cookie-parser");
 const rateLimit = require("express-rate-limit");
+const helmet = require("helmet");
 
 let sharp = null;
 try { sharp = require("sharp"); } catch (e) { }
@@ -26,6 +27,10 @@ const app = express();
 const server = http.createServer(app);
 const io = new Server(server, { cors: { origin: "*" } });
 
+app.use(helmet({
+  contentSecurityPolicy: false  // disable CSP for now — it would block CDN scripts
+}));
+
 app.use(express.json());
 app.use(cookieParser());
 app.use(requireAuth);
@@ -121,7 +126,7 @@ function requireAuth(req, res, next) {
   if (!config.auth.passphrase) return next(); // no passphrase set, skip
 
   // Allow the login route itself through
-  if (req.path === "/login" || req.path === "/info") return next();
+  if (req.path === "/login" || req.path === "/info" || req.path === "/health") return next();
 
 
   // Check cookie
@@ -411,19 +416,27 @@ app.post("/channels", (req, res) => {
   const { name } = req.body;
   if (!name) return res.status(400).json({ error: "Name required" });
 
+  const trimmed = name.trim();
+  if (trimmed.length < 1 || trimmed.length > 32) {
+    return res.status(400).json({ error: "Channel name must be 1–32 characters" });
+  }
+  if (!/^[a-zA-Z0-9 _\-]+$/.test(trimmed)) {
+    return res.status(400).json({ error: "Only letters, numbers, spaces, hyphens, and underscores allowed" });
+  }
+
   db.get("SELECT COUNT(*) as count FROM channels", (err, row) => {
 
     if (row.count >= 10) {
       return res.status(400).json({ error: "Max 10 channels allowed" });
     }
 
-    db.run("INSERT INTO channels (name) VALUES (?)", [name], function (err) {
+    db.run("INSERT INTO channels (name) VALUES (?)", [trimmed], function (err) {
 
       if (err) {
         return res.status(400).json({ error: "Channel exists" });
       }
-      io.emit("channel-added", { id: this.lastID, name });
-      res.json({ id: this.lastID, name });
+      io.emit("channel-added", { id: this.lastID, trimmed });
+      res.json({ id: this.lastID, name: trimmed });
 
     });
 
@@ -485,18 +498,25 @@ app.patch("/item/:id/move", (req, res) => {
 app.patch("/channels/:name", (req, res) => {
   const oldName = req.params.name;
   const { name: newName } = req.body;
-
   if (!newName) return res.status(400).json({ error: "Name required" });
 
+  const trimmed = newName.trim();
+  if (trimmed.length < 1 || trimmed.length > 32) {
+    return res.status(400).json({ error: "Channel name must be 1–32 characters" });
+  }
+  if (!/^[a-zA-Z0-9 _\-]+$/.test(trimmed)) {
+    return res.status(400).json({ error: "Only letters, numbers, spaces, hyphens, and underscores allowed" });
+  }
+
   db.get("SELECT * FROM channels WHERE name=?", [oldName], (err, row) => {
     if (!row) return res.status(404).json({ error: "Channel not found" });
 
-    db.run("UPDATE channels SET name=? WHERE name=?", [newName, oldName], (err) => {
+    db.run("UPDATE channels SET name=? WHERE name=?", [trimmed, oldName], (err) => {
       if (err) return res.status(400).json({ error: "Channel name already exists" });
 
-      db.run("UPDATE items SET channel=? WHERE channel=?", [newName, oldName], () => {
-        io.emit("channel-renamed", { oldName, newName });
-        res.json({ oldName, newName });
+      db.run("UPDATE items SET channel=? WHERE channel=?", [trimmed, oldName], () => {
+        io.emit("channel-renamed", { oldName, newName: trimmed });
+        res.json({ oldName, newName: trimmed });
       });
     });
   });
@@ -539,6 +559,15 @@ app.get("/branding", (req, res) => {
   });
 });
 
+/* HEALTH MONITOR */
+app.get("/health", (req, res) => {
+  res.json({
+    status: "ok",
+    uptime: Math.floor(process.uptime()),
+    version: require("../package.json").version
+  });
+});
+
 
 /* FAVICON */
 app.get("/favicon-dynamic.png", async (req, res) => {
@@ -570,6 +599,7 @@ app.get("/favicon-dynamic.png", async (req, res) => {
 });
 
 
+
 /* LOGO */
 app.get("/logo-dynamic.png", (req, res) => {
   const b = config.branding;