4 Commits

Author	SHA1	Message	Date
Elie Habib	f64af4c571	fix: harden CORS patterns & URL validation ... - Allow hyphens in Vercel preview URL patterns (worldmonitor-xxx-yyy) - Harden open_url command with proper URL parsing via reqwest::Url - Update YouTube embed test assertions for quote style change	2026-02-15 21:34:00 +04:00
Elie Habib	a9224254a5	fix: security hardening — CORS, auth bypass, origin validation & bump v2.2.7 ... - Tighten CORS regex to block worldmonitorEVIL.vercel.app spoofing - Move sidecar /api/local-env-update behind token auth + add key allowlist - Add postMessage origin/source validation in LiveNewsPanel - Replace postMessage wildcard '*' targetOrigin with specific origin - Add isDisallowedOrigin() check to 25 API endpoints missing it - Migrate gdelt-geo & EIA from custom CORS to shared _cors.js - Add CORS to firms-fires, stock-index, youtube/live endpoints - Tighten youtube/embed.js ALLOWED_ORIGINS regex - Remove 'unsafe-inline' from CSP script-src - Add iframe sandbox attribute to YouTube embed - Validate meta-tags URL query params with regex allowlist	2026-02-15 20:33:20 +04:00
Elie Habib	9b216843be	Fix YouTube playback in Tauri desktop with Player API and postMessage controls ... Switch bridge page from raw iframe to YouTube IFrame Player API with postMessage protocol for play/pause/mute commands. Use youtube-nocookie.com host, add click-to-play overlay for WKWebView autoplay restrictions, and route desktop embeds through cloud URL to avoid sidecar auth issues.	2026-02-14 20:22:37 +04:00
Elie Habib	ad4e52caee	Fix Tauri desktop runtime reliability and settings UX	2026-02-13 23:05:51 +04:00