 ciregenz
|
11784a9083
|
[eric] settings: the UPLOAD_DIR rename left the browser upload tool importing a deleted name; upload_dir()/legacy roots wired everywhere (ENG-312)
|
2026-08-16 01:53:48 -07:00 |
|
|
ciregenz
|
3ac55520d6
|
[eric] browser: the upload tool also finds inputs inside shadow roots and embedded frames, and a refused path names the exact staging copy that unblocks it (ENG-47)
|
2026-08-11 20:22:10 -07:00 |
|
|
ciregenz
|
ba97d141ee
|
[eric] browser: agents can attach a file to an upload field without the OS picker; the path is allow-listed backend-side so a hostile page cannot turn it into exfiltration (ENG-47)
|
2026-08-11 20:10:36 -07:00 |
|