From fc932dbc7eb7e8a767c21a9ebe3eb691c958ccde Mon Sep 17 00:00:00 2001 From: Sathish Date: Tue, 4 Aug 2026 11:30:46 +0530 Subject: [PATCH] =?UTF-8?q?fix(security):=20resolve=20audit=20findings=20?= =?UTF-8?q?=E2=80=94=20logging,=20endpoints,=20contact=20details?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Stop logging submitted password forms to the browser console - Drive analytics from NEXT_PUBLIC_UMAMI_* instead of a hardcoded vendor script URL and site ID; renders nothing when unset - Replace the wildcard image remote host "**" with an explicit allowlist (adds DigitalOcean Spaces) - Fix the socket URL fallback to the API port (:3001, was :4000) - Replace placeholder and personal contact emails with support@re-quest.com, including the privacy policy and terms pages Co-Authored-By: Claude Opus 5 (1M context) --- next.config.ts | 17 +++++------------ .../(agent)/agent/settings/password/page.tsx | 4 ++-- src/app/(user)/user/settings/password/page.tsx | 4 ++-- src/app/contact/page.tsx | 2 +- src/app/faq/page.tsx | 2 +- src/app/layout.tsx | 15 +++++++++------ src/app/privacy-policy/page.tsx | 4 ++-- src/app/terms-of-service/page.tsx | 4 ++-- src/components/settings/SubscriptionForm.tsx | 4 ++-- src/services/socket.service.ts | 2 +- 10 files changed, 27 insertions(+), 31 deletions(-) diff --git a/next.config.ts b/next.config.ts index d02b403..ae32f0c 100644 --- a/next.config.ts +++ b/next.config.ts @@ -7,18 +7,11 @@ const nextConfig: NextConfig = { // Image optimization images: { remotePatterns: [ - { - protocol: "https", - hostname: "**", - }, - { - protocol: "http", - hostname: "localhost", - }, - { - protocol: "http", - hostname: "127.0.0.1", - }, + { protocol: "https", hostname: "*.contabostorage.com" }, + { protocol: "https", hostname: "*.amazonaws.com" }, + { protocol: "https", hostname: "*.digitaloceanspaces.com" }, + { protocol: "http", hostname: "localhost" }, + { protocol: "http", hostname: "127.0.0.1" }, ], // Don't proxy external images through Next.js server // Avoids SSL cert issues with Contabo S3 (sin1.contabostorage.com) diff --git a/src/app/(agent)/agent/settings/password/page.tsx b/src/app/(agent)/agent/settings/password/page.tsx index 4dcfdc9..5d0d5a6 100644 --- a/src/app/(agent)/agent/settings/password/page.tsx +++ b/src/app/(agent)/agent/settings/password/page.tsx @@ -3,8 +3,8 @@ import { SettingsSidebar, PasswordSecurityForm } from '@/components/settings'; export default function PasswordSecurityPage() { - const handleSave = (data: { currentPassword: string; newPassword: string }) => { - console.log('Updating agent password:', data); + const handleSave = (_data: { currentPassword: string; newPassword: string }) => { + // TODO: call the change-password API. Do not log password payloads. }; return ( diff --git a/src/app/(user)/user/settings/password/page.tsx b/src/app/(user)/user/settings/password/page.tsx index b2b8363..00f2c52 100644 --- a/src/app/(user)/user/settings/password/page.tsx +++ b/src/app/(user)/user/settings/password/page.tsx @@ -3,8 +3,8 @@ import { SettingsSidebar, PasswordSecurityForm } from '@/components/settings'; export default function UserPasswordSecurityPage() { - const handleSave = (data: { currentPassword: string; newPassword: string }) => { - console.log('Updating user password:', data); + const handleSave = (_data: { currentPassword: string; newPassword: string }) => { + // TODO: call the change-password API. Do not log password payloads. }; return ( diff --git a/src/app/contact/page.tsx b/src/app/contact/page.tsx index 9beae7b..39a4aa9 100644 --- a/src/app/contact/page.tsx +++ b/src/app/contact/page.tsx @@ -31,7 +31,7 @@ interface ContactCta { const defaultContactDetails: ContactDetails = { title: 'Get In Touch', description: 'Have a question about a property or need assistance? Fill out the form below and our team will get back to you shortly.', - email: '123support@gmail.com', + email: 'support@re-quest.com', phone: '1234567890', phoneHours: 'Mon-Fri 9am-6pm', officeAddress: '123 Market Street', diff --git a/src/app/faq/page.tsx b/src/app/faq/page.tsx index 6449b8f..d9ec264 100644 --- a/src/app/faq/page.tsx +++ b/src/app/faq/page.tsx @@ -262,7 +262,7 @@ export default function FAQPage() { Start Live Chat {children} - {/* Umami analytics — loaded after page becomes interactive */} -