From a9e60e450cf7ce09776ae5ae2fa9af3fc29d77ac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gera=20G=2E=20G=C3=BCiles?= Date: Tue, 20 Oct 2026 11:27:07 +0200 Subject: [PATCH 1/3] fixed: autoquery() sorting without a direction suffix --- querybuilder.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/querybuilder.js b/querybuilder.js index 7c4e218..fb55196 100644 --- a/querybuilder.js +++ b/querybuilder.js @@ -1179,7 +1179,7 @@ QBP.autoquery = function(query, schema, defsort, maxlimit) { if ((skipped && skipped[name]) || (!allowed.meta[name])) continue; - t.sort(allowed.fields[name], item[index + 1] === 'd'); + t.sort(allowed.fields[name], index !== -1 && item.substring(index + 1).toLowerCase() === 'desc'); count++; } From 6d9859e9927630ce559b9e41ecda9e60c29c3b50 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gera=20G=2E=20G=C3=BCiles?= Date: Tue, 20 Oct 2026 17:01:19 +0200 Subject: [PATCH 2/3] fixed: @{csrf} in views called self.csrf() on the view instead of the controller --- viewengine.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/viewengine.js b/viewengine.js index 5300bcf..89d8b06 100755 --- a/viewengine.js +++ b/viewengine.js @@ -324,7 +324,7 @@ function prepare(command, dcommand, functions) { return 'self.safehtml(' + command + ')'; case 'csrf': - return 'self.csrf()'; + return '(controller?controller.csrf():$EMPTY)'; case 'root': var r = F.config.$root; From 579e0ec8c40658392dfe9eb50f99c4a3a63b92df Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gera=20G=2E=20G=C3=BCiles?= Date: Tue, 20 Oct 2026 17:53:04 +0200 Subject: [PATCH 3/3] fixed: measureJPG() looped forever (and blocked the server) with a damaged JPEG --- images.js | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/images.js b/images.js index 995f679..cac14f3 100755 --- a/images.js +++ b/images.js @@ -39,13 +39,23 @@ exports.measureJPG = function(buffer) { if (jpeg) { o += 2; while (o < len) { - while (0xff != buffer[o]) o++; - while (0xff == buffer[o]) o++; + + // A damaged file must not loop forever: stay inside the buffer + while (o < len && 0xff != buffer[o]) o++; + while (o < len && 0xff == buffer[o]) o++; + + if (o >= len) + break; + if (SOF[buffer[o]]) return { width: u16(buffer, o + 6), height: u16(buffer, o + 4) }; - else - o += u16(buffer, ++o); + // The length of a segment includes its own two bytes: less than 2 is not valid + var size = u16(buffer, o + 1); + if (!(size >= 2)) + break; + + o += size; } }