security: CORS hardening, path traversal fix, WebSocket auth + cleanup

Browse Source

- Restrict CORS to localhost origins (was allow_origins=[*])
- Require valid JWT on WebSocket /ws (anonymous no longer gets admin view)
- Fix path traversal in delete_cell(): resolve() + parent check
- Validate cell_id format in /charts/download-noaa/{cell_id}
- Exclude charts/ and Cartas/ from git (keep US1GC09M world overview)
- Add NOAA ENC Portal external link in charts catalog tab
- Untrack __pycache__/, .db, .claude/ session files

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

...

This commit is contained in:

Alvaro Enrique Romero Donado

2026-07-03 12:45:43 -04:00

parent 3e04c4113f

commit cfd94f905a

47 changed files with 1847 additions and 427 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

frontend/js/map.js

+810 -62

File diff suppressed because it is too large Load Diff