Spaces:
Running
Running
Commit History
-
Sync analysis UI from RodSizer; refresh index docs (keep session + HF notice)
- analysis.html: replace with the current RodSizer analysis page (interactive overlay with thin vivid outlines + two-blink flash, point-in-polygon click-to-deselect that no longer scrolls the table, sortable selection table, ⋮ bulk select/deselect above/below, "Deselect outliers" (Tukey IQR), toggle ID labels hidden by default, PDF that composites the live overlay). Re-grafted the session_id fetch wrapper and appended session_id to the processed/binary image src so the public build stays session-scoped. - index.html: update the About modal (watershed + OCR + rotated-box) and Upload Instructions (metadata -> OCR -> manual calibration order; on-page curation tools), keeping the HF data-retention notice, credits/links and session wiring. Fix the retention notice to match the backend TTL (24 h, was "15 mins"). - folder_analysis.html unchanged (already current bar the session block). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>911d85d
-
Harden session/path/ID validation and fix XSS for public-facing web version
Session IDs, image IDs, folder names, and result filenames flow directly into filesystem paths in /tmp/uploads/<session>/ and /tmp/results/<session>/. Because this build runs on public Hugging Face Spaces, an attacker could previously use ../ in session_id or filename to read/write other sessions or arbitrary container paths. - Enforce a strict format for session_id (8–128 chars, [A-Za-z0-9_-]) and reject traversal tokens; resolve per-session dirs under the root. - Validate image_id as UUID4 before any rglob() to block glob-metacharacter injection. - Sanitize folder names (reject "." / ".." / separators) and _safe_join them under the session upload dir. - Rewrite /results/{filename} to forbid traversal, glob metacharacters, and control chars, and verify the resolved path stays inside the session dir. - Rebuild gallery cards and table rows with DOM APIs so user-supplied filenames and IDs cannot inject HTML or inline-event handlers. - Cap upload size (200 MB per file) and file…6e77125
-
Fix image display: append session_id to img.src URLs
59f5e9f -
Add line break in credits before See HERE line
620e9a3 -
Simplify About modal credits section
0fcbf72 -
Remove warning icon and tone down RodSizer_local link style
57373bb -
Redesign header warning notice with better styling
3de6cb1 -
Improve header notice visibility and accuracy
bf359a4 -
Add web demo notice with session/storage warning in header
02ad7eb -
Add per-session file isolation for multi-user support
de3e784 -
Make Murphy's Group and HERE into hyperlinks in About section
86f3dca -
Update credits in About section
bb552ac -
Initial commit
065e391