web-player: fix open redirect via returnTo, require SESSION_SECRET and validate API inputs

2026-09-24 04:58:08 +02:00
parent b2f450dcf7
commit 3e546d4a1e
12 changed files with 64 additions and 13 deletions
@@ -1,4 +1,5 @@
 export const EXPLORE_PAGE_SIZE = 27;
+export const MAX_PAGE_SIZE = 100;
 export const SEARCH_DEBOUNCE_MS = 450;
 export const SEARCH_MIN_LENGTH = 2;
 export const INFINITE_SCROLL_ROOT_MARGIN = '300px';