Oliver Falk
d37ae1456c
feat: implement comprehensive file upload security
...
- Add comprehensive file validation with magic bytes, MIME type, and PIL checks
- Implement malicious content detection and polyglot attack prevention
- Add EXIF data sanitization to prevent metadata leaks
- Enhance UploadPhotoForm with security validation
- Add security logging for audit trails
- Include comprehensive test suite for security features
- Add python-magic dependency for MIME type detection
- Update configuration with security settings
- Add detailed documentation for file upload security
Security features:
- File type validation (magic bytes + MIME type)
- Content security scanning (malware detection)
- EXIF data sanitization (privacy protection)
- Enhanced logging (security event tracking)
- Comprehensive test coverage
Removed rate limiting as requested for better user experience.
2025-10-15 15:30:32 +02:00
Oliver Falk
368aa5bf27
feat: enhance security with improved password hashing and logging
...
- Add Argon2PasswordHasher with high security settings as primary hasher
- Implement fallback to PBKDF2PasswordHasher for CentOS 7/Python 3.6 compatibility
- Add argon2-cffi dependency to requirements.txt
- Replace all print statements with proper logging calls across codebase
- Implement comprehensive logging configuration with multiple handlers:
* ivatar.log - General application logs (INFO level)
* ivatar_debug.log - Detailed debug logs (DEBUG level)
* security.log - Security events (WARNING level)
- Add configurable LOGS_DIR setting with local config override support
- Create config_local.py.example with logging configuration examples
- Fix code quality issues (flake8, black formatting, import conflicts)
- Maintain backward compatibility with existing password hashes
Security improvements:
- New passwords use Argon2 (memory-hard, ASIC-resistant)
- Enhanced PBKDF2 iterations for fallback scenarios
- Structured logging for security monitoring and debugging
- Production-ready configuration with flexible log locations
Tests: 85/113 passing (failures due to external DNS/API dependencies)
Code quality: All pre-commit hooks passing
2025-10-15 15:13:09 +02:00
