- Shipped
- October 24, 2025 at 9:05 PM UTC
- Author
- snadjafinia
- Commit
- b3e4c55
Security enhancements to prevent localStorage manipulation: 1. useUserInfo hook: - Add isGodModeActive() method with dual validation - Check 1: User has god permission (from session) - Check 2: God mode enabled in localStorage - Returns false if either check fails 2. NavTop component: - Use secure isGodModeActive() from hook - Auto-clear localStorage if permission lost - Warning logged when permission mismatch detected Security flow: - Even if user manually sets localStorage.godModeActive=true - isGodModeActive() will return false if getIsGod()=false - Prevents bypassing permission check via browser devtools Protection against: - localStorage manipulation - Permission revocation during active session - Cookie tampering (session verification required) All components using god mode should call isGodModeActive() instead of reading localStorage directly.