Security fixes: path traversal, filename injection, input validation, error leakage

Meyton Message Protocol.md

@@ -0,0 +1,12 @@
+# Meyton Message Protocol
+
+Target IP: 224.0.0.3 UDP, Port:49497
+
+| Start Address | Type     | Size (Bytes)   | Description                                                                                                 |
+| ------------- | -------- | -------------- | ----------------------------------------------------------------------------------------------------------- |
+| 0x00          | bytes    | 36             | 00 00 03 01 06 08 53 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 00 00 00 00 00 00 00 01 00 00 00 |
+| 0x24          | uint32   | 4              | Message ID, 0x35 for Message, 0xFB is for a simulated button press                                          |
+| 0x28          | Bitfield | 52 / 53        | Target RangeNo (1-416), lsb of 0x28 gets ignored                                                            |
+| 0x5D          | Unknown  | 79             | Padding? Always 0x00                                                                                        |
+| 0xAC          | uint32   | 4              | Message Length                                                                                              |
+| 0xB0          | char[]   | Message Length | ASCII (HTML) Message Content                                                                                |

database/local/docker-compose.yaml

@@ -19,7 +19,7 @@ services:
       timeout: 5s
       retries: 5
     volumes:
-      - postgres_data:/var/lib/postgresql/data
+      - postgres_data:/var/lib/postgresql
   dc-db-migrate:
     container_name: dc-db-migrate
     image: ghcr.io/svenfinn/dc-db-migrate:${APP_VERSION}

database/local/migrations/20241010070636_add_known_ranges/migration.sql

@@ -11,6 +11,3 @@ CREATE TABLE "public"."KnownRanges" (
 
 -- CreateIndex
 CREATE UNIQUE INDEX "KnownRanges_rangeId_key" ON "public"."KnownRanges"("rangeId");
-
--- CreateIndex
-CREATE UNIQUE INDEX "KnownRanges_lastIp_key" ON "public"."KnownRanges"("lastIp");

database/local/package.json

@@ -13,15 +13,15 @@
     "license": "ISC",
     "description": "",
     "dependencies": {
-        "@prisma/adapter-pg": "^7.3.0",
-        "@prisma/client": "^7.3.0",
-        "dotenv": "^17.2.3",
-        "pg": "^8.17.2"
+        "@prisma/adapter-pg": "^7.5.0",
+        "@prisma/client": "^7.5.0",
+        "dotenv": "^17.3.1",
+        "pg": "^8.20.0"
     },
     "devDependencies": {
-        "@types/node": "^25.0.9",
-        "@types/pg": "^8.16.0",
-        "prisma": "^7.3.0",
+        "@types/node": "^25.5.0",
+        "@types/pg": "^8.18.0",
+        "prisma": "^7.5.0",
         "typescript": "^5.9.3"
     },
     "files": [

database/local/pgadmin/docker-compose.yaml

@@ -23,5 +23,3 @@ services:
     depends_on:
       dc-database:
         condition: service_healthy
-      dc-db-migrate:
-        condition: service_completed_successfully

database/local/schema.prisma

@@ -58,7 +58,7 @@ enum CacheTypes {
 model KnownRanges {
     macAddress String   @id
     rangeId    Int?     @unique
-    lastIp     String?  @unique @db.Inet
+    lastIp     String?  @db.Inet
     createdAt  DateTime @default(now())
     updatedAt  DateTime @default(now()) @updatedAt
 }

database/smdb/package.json

@@ -10,15 +10,15 @@
         "generate": "npx prisma generate --no-hints"
     },
     "devDependencies": {
-        "@types/node": "^25.0.9",
-        "prisma": "^7.3.0",
+        "@types/node": "^25.5.0",
+        "prisma": "^7.5.0",
         "typescript": "^5.9.3"
     },
     "dependencies": {
-        "@prisma/adapter-mariadb": "^7.3.0",
-        "@prisma/client": "^7.3.0",
+        "@prisma/adapter-mariadb": "^7.5.0",
+        "@prisma/client": "^7.5.0",
         "dc-db-local": "file:../local",
-        "dotenv": "^17.2.3"
+        "dotenv": "^17.3.1"
     },
     "files": [
         "dist",

database/smdb/schema.prisma

@@ -660,11 +660,11 @@ model Shooter {
     image       Bytes?   @map("SchuetzenFoto") @db.MediumBlob
 
     shooterFilters FilterShooter[]
-    club           Club               @relation(fields: [clubId], references: [id], map: "Schuetze_ibfk_1")
-    nation         Country            @relation(fields: [nationShort], references: [short], map: "Schuetze_ibfk_2")
+    club           Club             @relation(fields: [clubId], references: [id], map: "Schuetze_ibfk_1")
+    nation         Country          @relation(fields: [nationShort], references: [short], map: "Schuetze_ibfk_2")
     seedingLists   SeedingList[]
     startListEntry StartListEntry[]
-    clubShooters   Vereinszuordnung[]
+    clubShooters   ClubAssoc[]
 
     @@index([nationShort], map: "LandesKuerzel")
     @@index([lastName], map: "Nachname")
@@ -804,14 +804,14 @@ model Club {
     teams            Team[]
     shooters         Shooter[]
     startListEntries StartListEntry[]
-    union            Union              @relation(fields: [unionId], references: [id], map: "Verein_ibfk_1")
-    clubShooter      Vereinszuordnung[]
+    union            Union            @relation(fields: [unionId], references: [id], map: "Verein_ibfk_1")
+    clubShooter      ClubAssoc[]
 
     @@index([unionId], map: "VerbandsID")
     @@map("Verein")
 }
 
-model Vereinszuordnung {
+model ClubAssoc {
     shooterId BigInt @map("SportpassID")
     clubId    Int    @map("VereinsID")
 
@@ -823,11 +823,8 @@ model Vereinszuordnung {
     @@map("Vereinszuordnung")
 }
 
-// Contains version numbers of the database
 model Version {
-    Versionsnummer Int
-
-    @@ignore
+    version Int @unique @map("Versionsnummer") @db.Int
 }
 
 model Zeit {