From 7289cde03aea70943cbb5bd1685faaabb7010d2c Mon Sep 17 00:00:00 2001 From: Till Heidrich Date: Tue, 18 Aug 2026 07:50:30 +0000 Subject: [PATCH] docs: changelog for the code-review fixes --- CHANGELOG.md | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 80dcfb2..6b02eaa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,42 @@ All notable changes to Klarbild are documented here. Newest first. +## 2026-08-18 (3) — Code review: fixes + +### Fixed +- **EXIF orientation was ignored.** Phone photos carry their rotation as metadata only. + sharp cropped the unrotated raster, so a portrait shot came out of the printer sideways + and with the wrong framing. Orientation is now applied before any geometry, and + `/api/uploads` reports oriented dimensions so the crop editor agrees with the render. +- **Memory blow-up on "Rand lassen".** The padded image was materialised at source + resolution before the resize. A panorama into a narrow contain target built a ~960 MB + intermediate and then failed outright; it is one extract→resize→extend chain now + (sharp's own order) — 90 ms and a few MB. +- **`bleedMm` was unbounded** in `/api/print/single` (the sheet endpoint clamped it). +- **Delivery gallery could escape the target's base folder** — `posixpath.join` happily + resolves `../..`, and the folder is created before upload. Names are validated now. +- **Denial of service:** sheet requests are capped at 500 pieces and the packer has a + step budget, so a degenerate request can no longer block the single-threaded server. +- **Print presets:** delete only your own (admins all), config size and count limits, + and `by_name` honours `anonymous_generations`. +- **Telegram callbacks** now require an active pairing, like every other path. +- **Error responses** no longer leak storage paths or delivery hostnames. +- `allowRotate: undefined` meant "no rotation" in one place and "rotation allowed" in + two others — a picture that only fits rotated was reported as unplaceable. +- The many-formats shortcut dropped a format that only fits rotated. +- `unplaced` blamed the first format instead of the one actually missing. +- Corner marks could land inside the printed bleed; the offset is raised to clear it. +- `capacity()` silently capped at 200. +- Image keys could collide with a cell literally named `x::rot`. +- `labelMm` rounded away real decimals (11,25 cm became 11,3); `parseSizeMm` ignored the + order in `a:b`, so `3:4/15` and `4:3/15` produced the same portrait size. +- The footer was drawn over the artwork when the margin was small. +- The UI now warns when corner marks do not fit the margin, and when continuous guides + are combined with mixed sizes (they cannot run through). + +### Changed +- Tests grew from 21 to 31 — every finding above has a regression test. + ## 2026-08-18 (2) — Passbildfunktion: all sizes, fit rules, mobile ### Added