chris a8b1c68d97 feat: fix double punch, XSS, add log filtering and Easter egg ...

- Fix duplicate clock-in: server-side BEGIN IMMEDIATE transaction + client-side punchInFlight guard
- Fix accumulating event listeners: switch persistent containers to onclick property assignment
- Remove insecure JWT_SECRET fallback; server refuses to start without it set
- Add escapeHtml and apply it throughout all innerHTML template literals (XSS prevention)
- Fix calendar iframe URL injection by assigning iframe.src directly
- Add status validation on time-off status update endpoint
- Add date range filtering to admin logs tab and employee time log
- Replace Konami code Easter egg with 7-tap logo trigger (works on all devices)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-28 16:42:34 -04:00

public

feat: fix double punch, XSS, add log filtering and Easter egg

2026-05-28 16:42:34 -04:00

.env.example

feat: improve calendar layout

2026-02-12 12:45:45 -05:00

.gitignore

update gitignore

2025-07-31 10:46:12 -04:00

docker-compose.yaml

fix view archives and add delete time off request

2025-07-29 17:00:15 -04:00

Dockerfile

chore: version service worker cache

2026-02-11 19:58:15 -05:00

package.json

add notifications

2025-10-09 12:22:23 -04:00

server.js

feat: fix double punch, XSS, add log filtering and Easter egg

2026-05-28 16:42:34 -04:00

Description

No description provided

1.3 MiB

Languages

JavaScript 94.9%

HTML 3.2%

CSS 1.4%

Dockerfile 0.5%