Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
43 commits
Select commit Hold shift + click to select a range
a7a751c
refactor: refactor 1
shinwokkang Feb 16, 2026
bab8330
refactor: 약관 동의서 텍스트 클릭 시 나오도록 수정 및 모바일 화면 텍스트 너비 수정
shinwokkang Feb 16, 2026
824ccdb
style: 헤더 높이 수정
bini0918 Feb 16, 2026
ff0d0c5
style: 헤더에 양옆 여백 추가
bini0918 Feb 16, 2026
309dcd7
style: 책이야기 반응형 수정
bini0918 Feb 16, 2026
1449764
style: 홈화면 여백 맞추기
bini0918 Feb 16, 2026
a39c8b9
style: 댓글 최신순으로 배열
bini0918 Feb 16, 2026
8325a9a
style: 대댓글 반응형 수정
bini0918 Feb 16, 2026
5146a95
style: 책이야기 작성 상단 반응형 수정
bini0918 Feb 16, 2026
7747f82
style: 검색 모달 반응형 수정
bini0918 Feb 16, 2026
fc3f28b
style: 검색 모달 애니메이션 추가
bini0918 Feb 16, 2026
cd7be42
style: 책이야기카드 사이 간격 조정
bini0918 Feb 16, 2026
86ab527
style: 공지사항 페이지네이션 추가
bini0918 Feb 16, 2026
524c1ba
style: 페이지네이션 반응형 추가
bini0918 Feb 16, 2026
f55edb8
style: 페이지네이션 반응형 수정
bini0918 Feb 16, 2026
b10d661
style: 공지사항 작성 모바일 여백 추가
bini0918 Feb 16, 2026
0bc34dd
refactor: 마이페이지 피드백 내용 반영
shinwokkang Feb 17, 2026
127aef3
refactor: 마이페이지 내 책 이야기 피드백 내용 반영
shinwokkang Feb 17, 2026
0eba71d
refactor: 다른 사람 프로필 조회 피드백 반영
shinwokkang Feb 17, 2026
c386f06
feat: 리뷰 내용 반영
shinwokkang Feb 17, 2026
5bb2b2a
Merge pull request #97 from checkmo2025/refactor-95-signup-feedback
shinwokkang Feb 17, 2026
1ea3d5a
Merge pull request #98 from checkmo2025/style-96-ui-change
shinwokkang Feb 17, 2026
cbd25fc
feat: 회원가입 및 로그인 로직 구현 완료
shinwokkang Feb 17, 2026
bc87eb9
feat: 페이지 다이렉션 로직 구조 구현
shinwokkang Feb 17, 2026
a9cc9c6
chore : vercel dependecies 추가
Feb 18, 2026
9b88130
style : 모임 - 모임홈 페이지 수정
Feb 18, 2026
e1a59c9
style : 모임 - 모임검색하기
Feb 18, 2026
b285b58
style : 책장/정기모임
Feb 18, 2026
d9500ff
style : 모임 - 검색(필터)
Feb 19, 2026
b9f8db7
style : 호버등 작업 - 모임, 모임생성, 책장 등 많은 페이지
Feb 19, 2026
7d1910b
style : float 통일
Feb 19, 2026
35ba306
Merge pull request #105 from checkmo2025/style-103
shinwokkang Feb 19, 2026
ae3a80b
feat: implement backend logout, floating login button, and improve si…
shinwokkang Feb 23, 2026
6dbeea3
fix: resolve merge conflicts and update lockfiles for Vercel deploy
shinwokkang Feb 23, 2026
7eabd9b
refactor: centralize auth guard with useAuthGuard hook and fix profil…
shinwokkang Feb 23, 2026
5c2b7fb
Merge pull request #102 from checkmo2025/feat/101-auth-api
shinwokkang Feb 23, 2026
344009a
fix: implement security and logic improvements based on code review f…
shinwokkang Feb 23, 2026
4b35cfc
fix: auto-login after signup to prevent 403 forbidden during profile …
shinwokkang Feb 23, 2026
f844679
chore: 주석 제거
shinwokkang Feb 23, 2026
cdeba8f
Merge pull request #111 from checkmo2025/feat/101-auth-api
shinwokkang Feb 23, 2026
f1710b9
refactor: apply code review feedback (constants, endpoints, error han…
shinwokkang Feb 23, 2026
51dfd20
fix: replace any with unknown in catches, update default profile imag…
shinwokkang Feb 23, 2026
eafc56d
Merge pull request #112 from checkmo2025/feat/101-auth-api
shinwokkang Feb 23, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
273 changes: 212 additions & 61 deletions package-lock.json

Large diffs are not rendered by default.

2 changes: 2 additions & 0 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
"react": "19.2.0",
"react-dom": "19.2.0",
"react-hot-toast": "^2.6.0",
"zod": "^4.3.6",
"zustand": "^5.0.10"
},
"devDependencies": {
Expand All @@ -27,6 +28,7 @@
"@types/react-dom": "^19",
"autoprefixer": "^10.4.21",
"babel-plugin-react-compiler": "1.0.0",
"baseline-browser-mapping": "^2.9.19",
"eslint": "^9",
"eslint-config-next": "^16.1.6",
"postcss": "^8.5.6",
Expand Down
30 changes: 18 additions & 12 deletions pnpm-lock.yaml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions public/icons_calling.svg
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
6 changes: 6 additions & 0 deletions public/icons_chat.svg
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
3 changes: 3 additions & 0 deletions public/icons_pencil.svg
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
97 changes: 50 additions & 47 deletions src/app/(main)/books/[id]/page.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@
import { useState } from "react";
import { useParams, useRouter } from "next/navigation";
import SearchBookResult from "@/components/base-ui/Search/search_bookresult";
import BookStoryCard from "@/components/base-ui/BookStory/bookstory_card";
import { DUMMY_STORIES } from "@/data/dummyStories";
import BookStoryCardLarge from "@/components/base-ui/BookStory/bookstory_card_large";

export default function BookDetailPage() {
const params = useParams();
Expand All @@ -23,58 +23,61 @@ export default function BookDetailPage() {

// 관련된 책 이야기들 (더미 데이터에서 필터링)
const relatedStories = DUMMY_STORIES.filter(
(story) => story.bookTitle === bookData.title
(story) => story.bookTitle === bookData.title,
);

return (
<div className="max-w-[1040px] mx-auto px-4 py-6 t:px-6 t:py-8">
<p className="text-Gray-7 body_1 t:subhead_1 mb-5">
도서 선택 <span className="text-primary-2">{bookData.title}</span> 중
</p>
<div className="mx-auto px-4 py-6 t:px-6 t:py-8">
<div className="max-w-[1043px] mx-auto">
<p className="text-Gray-7 body_1 t:subhead_1 mb-5">
도서 선택 <span className="text-primary-2">{bookData.title}</span> 중
</p>

{/* 선택한 책 카드 */}
<div className="mb-14">
<SearchBookResult
imgUrl={bookData.imgUrl}
title={bookData.title}
author={bookData.author}
detail={bookData.detail}
liked={liked}
onLikeChange={setLiked}
onPencilClick={() => {
router.push(`/stories/new?bookId=${bookId}`);
}}
/>
</div>
{/* 선택한 책 카드 */}
<div className="mb-14">
<SearchBookResult
imgUrl={bookData.imgUrl}
title={bookData.title}
author={bookData.author}
detail={bookData.detail}
liked={liked}
onLikeChange={setLiked}
onPencilClick={() => {
router.push(`/stories/new?bookId=${bookId}`);
}}
/>
</div>

{/* 책이야기 */}
<div className="mb-5">
<h2 className="text-Gray-7 body_1 t:subhead_1">
책이야기 <span className="text-primary-2">{relatedStories.length}</span>
</h2>
</div>
{/* 책이야기 */}
<div className="mb-5">
<h2 className="text-Gray-7 body_1 t:subhead_1">
책이야기{" "}
<span className="text-primary-2">{relatedStories.length}</span>
</h2>
</div>

{/* 책 이야기 카드 */}
<div className="grid grid-cols-1 t:grid-cols-2 d:grid-cols-3 gap-3.5 justify-items-center">
{relatedStories.map((story) => (
<div
key={story.id}
onClick={() => router.push(`/stories/${story.id}`)}
className="cursor-pointer"
>
<BookStoryCard
authorName={story.authorName}
createdAt={story.createdAt}
viewCount={story.viewCount}
coverImgSrc={story.bookImageUrl}
title={story.title}
content={story.content}
likeCount={story.likeCount}
commentCount={story.commentCount}
subscribeText="구독"
/>
</div>
))}
{/* 책 이야기 카드 */}
<div className="grid grid-cols-1 t:grid-cols-2 d:grid-cols-3 gap-5 justify-items-center">
{relatedStories.map((story) => (
<div
key={story.id}
onClick={() => router.push(`/stories/${story.id}`)}
className="cursor-pointer"
>
<BookStoryCardLarge
authorName={story.authorName}
createdAt={story.createdAt}
viewCount={story.viewCount}
coverImgSrc={story.bookImageUrl}
title={story.title}
content={story.content}
likeCount={story.likeCount}
commentCount={story.commentCount}
subscribeText="구독"
/>
</div>
))}
</div>
</div>
</div>
);
Expand Down
20 changes: 5 additions & 15 deletions src/app/(main)/news/[id]/page.tsx
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
import FloatingFab from "@/components/base-ui/Float";
import TodayRecommendedBooks from "@/components/base-ui/News/today_recommended_books";
import Image from "next/image";
Comment on lines +1 to 3
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check installed React, React-DOM, and Next.js versions in package.json
fd -g 'package.json' -E 'node_modules' --exec grep -H '"react"\|"next"\|"react-dom"' {}

Repository: checkmo2025/FE

Length of output: 175


🌐 Web query:

CVE-2025-55182 CVE-2025-66478 React 19.2.0 RCE

💡 Result:

  • CVE-2025-55182 (“React2Shell”): a pre-auth unauthenticated RCE in React Server Components (RSC) due to unsafe deserialization in the RSC/“Flight” protocol. It affects React 19.0.0, 19.1.0, 19.1.1, and 19.2.0 (notably the react-server-dom-* packages). React 19.2.0 is vulnerable. Patched in React 19.2.1 (and also in the 19.0/19.1 patch lines). [1][2] (cloud.google.com)
  • CVE-2025-66478 (Next.js): this was the Next.js tracking ID for the same underlying issue in frameworks bundling vulnerable RSC (e.g., Next.js 15.x/16.x App Router), and was later marked as a duplicate of CVE-2025-55182. Upgrade Next.js to one of the listed patched releases. [1][3] (cloud.google.com)

What to do: if you run React 19.2.0, upgrade at least to React 19.2.1 (and upgrade Next.js to a patched version if applicable), then redeploy. [1] (cloud.google.com)

Sources
[1] Google Cloud blog: “Responding to CVE-2025-55182” (cloud.google.com)
[2] NVD entry for CVE-2025-55182 (nvd.nist.gov)
[3] CIRCL/Vulnerability-Lookup entry for CVE-2025-66478 (cve.circl.lu)

Citations:


🌐 Web query:

CVE-2025-55184 CVE-2025-67779 React infinite loop DoS

💡 Result:

CVE-2025-55184 and CVE-2025-67779 are high-severity (CVSS 7.5) denial-of-service (DoS) issues in React Server Components / Server Functions: a specially crafted HTTP request to a Server Function endpoint can trigger unsafe deserialization that leads to an infinite loop, pegging CPU and hanging the server process (pre-auth, no user interaction). CVE-2025-67779 exists because the original fix for CVE-2025-55184 was incomplete. [1][3]

What to do

  • Upgrade React to patched versions. React’s advisory notes additional fixes were published Jan 26, 2026, and states React 19.0.4 / 19.1.5 / 19.2.4 are safe. [1]
  • If you can’t upgrade immediately, consider edge/WAF mitigation: Fastly released a virtual patch for CVE-2025-55184 that also covers CVE-2025-67779 (enabled by default for their Next‑Gen WAF customers). [2]

Who is most likely affected

  • Apps using React Server Components / Server Functions (commonly via frameworks like Next.js App Router and other RSC-enabled setups). [3][1]

Sources: React security advisory (React.dev) [1], Fastly WAF virtual patch notice [2], Orca Security write-up [3].


🌐 Web query:

CVE-2026-23864 React vulnerability

💡 Result:

CVE-2026-23864 is a high-severity (CVSS 7.5) denial-of-service (DoS) vulnerability in React Server Components (RSC). It can be triggered by specially crafted HTTP requests to Server Function endpoints, potentially causing server crashes, out-of-memory conditions, or excessive CPU usage. (react.dev)

What’s affected (React):

  • RSC runtime packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack
  • Vulnerable versions: 19.0.0–19.2.3 (including 19.0.3 / 19.1.4 / 19.2.3, which were incomplete fixes) (react.dev)
  • Fixed versions: 19.0.4, 19.1.5, 19.2.4 (react.dev)

What’s affected (Next.js / frameworks using RSC):

  • Impacts frameworks that actively use RSC (not “React on the client” by itself). (react.dev)
  • Akamai lists Next.js fixes (examples): 15.0.8, 15.1.11, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 16.0.11, 16.1.5, plus canary fixes; and notes some older major lines “will not be fixed.” (akamai.com)

Am I affected if I only use React in the browser (no server / no RSC)?

  • Generally no—if you don’t use a server or a framework/bundler that supports React Server Components, you’re not affected. (react.dev)

What to do

  • Upgrade immediately to one of the patched React RSC versions (19.0.4 / 19.1.5 / 19.2.4) and update your framework (e.g., Next.js) accordingly. (react.dev)

Citations:


🌐 Web query:

CVE-2025-55182 CVSS score severity React 19.2.0

💡 Result:

  • CVE-2025-55182 (React2Shell) CVSS / severity: CVSS base score 10.0 — Critical (as assigned by CVE.org per Google’s advisory). [1]
  • React 19.2.0 status: Vulnerable (affected React versions include 19.0.0, 19.1.0, 19.1.1, 19.2.0), fixed in 19.2.1. [1]
  • Why you may see a different score in some tools: Sonatype reports CVSS v4 = 9.3 (Critical) due to its own scoring/precedence while NVD had not yet published an NVD-assessed CVSS vector at the time of their note (and NVD may still show “assessment not yet provided”). [2] [3]

Sources: [1] [2] [3]


🌐 Web query:

React 19.2.4 CVE-2026-23864 patched versions 19.2.1 19.2.3

💡 Result:

CVE-2026-23864 (DoS in React Server Components / Server Functions) affects the react-server-dom-* packages—not the “react” package in general—and 19.2.1 and 19.2.3 are still vulnerable (they were earlier/incomplete fixes). (react.dev)

Fixed (patched) versions:

Affected examples (19.2 line):

Citations:


🌐 Web query:

Next.js 16.1.6 CVE-2026-23864 patch

💡 Result:

Next.js 16.1.6 is already patched for CVE-2026-23864—Vercel’s advisory lists 16.1.5 as the first fixed release in the 16.1 line, so anything ≥ 16.1.5 (including 16.1.6) is not affected. [1][2]

Patch / upgrade:

npm i next@16.1.6
# or
yarn add next@16.1.6
# or
pnpm add next@16.1.6

If you can’t move to 16.1.6 for some reason, the minimum safe target is next@16.1.5. [1][2]


🌐 Web query:

Next.js 16.1.5 16.1.6 CVE-2026-23864 patched versions

💡 Result:

For CVE-2026-23864 in Next.js (App Router / Server Components), the Next.js 16.x patch levels are:

  • Vulnerable: >= 16.0.0 and < 16.1.5 (so 16.1.4 and earlier are vulnerable). [1]
  • Patched (minimum safe):
    • 16.0.11 (for the 16.0.x line) [1]
    • 16.1.5 (first fixed release for the 16.1.x line) [1][2]
  • Therefore 16.1.5 is patched, and 16.1.6 (newer than 16.1.5) is also patched. [1][3]

Sources: [1] GitHub Security Advisory (vercel/next.js) GHSA-h25m-26qc-wcjf, [2] Akamai advisory, [3] Next.js GitHub release tag v16.1.6.


Upgrade react and react-dom to 19.2.4+ — active RCE and DoS CVEs affect 19.2.0

The project uses react@19.2.0 / react-dom@19.2.0, which are confirmed vulnerable in multiple advisories that directly affect App Router server components like this page:

CVE Severity Impact Fixed in React
CVE-2025-55182 / CVE-2025-66478 CVSS 10.0 Critical Unauthenticated attacker can execute arbitrary code on a server using nothing more than a crafted HTTP request 19.2.1+
CVE-2025-55184 / CVE-2025-67779 CVSS 7.5 High An attacker can force a vulnerable application server into an infinite loop by crafting a specific request 19.2.4+
CVE-2026-23864 CVSS 7.5 High DoS via specially crafted HTTP requests (January 2026) 19.2.4+

The vulnerability is present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0; initial fixes were incomplete through 19.2.3. A complete fix was issued in versions 19.0.4, 19.1.5, and 19.2.4.

Action: Upgrade react and react-dom to 19.2.4+ immediately. Next.js 16.1.6 already includes the patch for CVE-2026-23864 (patched from 16.1.5 onwards).

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/app/`(main)/news/[id]/page.tsx around lines 1 - 3, This file is a server
component and the project currently depends on vulnerable React versions; update
the react and react-dom dependencies to at least 19.2.4 (e.g., in package.json
replace react/react-dom 19.2.0 with 19.2.4+), regenerate the lockfile
(npm/yarn/pnpm install) to update package-lock.json or pnpm-lock.yaml, ensure
Next.js is at 16.1.6+ if using that patch, run the full test/build (including
pages using FloatingFab, TodayRecommendedBooks, and next/image) and redeploy to
confirm no runtime/SSR regressions.

import { notFound } from "next/navigation";
Expand Down Expand Up @@ -159,21 +160,10 @@ export default async function NewsDetailPage({ params }: Props) {
<div className="w-screen -mx-4 my-8 border-b-4 border-Gray-1 mt-25"></div>
<TodayRecommendedBooks books={DUMMY_BOOKS} className="mt-10" />

{/* 문의하기 */}
<button
type="button"
className="fixed bottom-[86px] right-6 t:bottom-8 t:right-8 z-[60] cursor-pointer hover:opacity-80 transition-opacity w-12 h-12 t:w-[88px] t:h-[88px]"
aria-label="문의하기"
>
<Image
src="/inquiry.svg"
alt="문의하기"
width={88}
height={88}
className="w-full h-full"
priority
/>
</button>
<FloatingFab
iconSrc="/icons_calling.svg"
iconAlt="문의하기"
/>
Comment on lines +163 to +166
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

"문의하기" FloatingFab has no onClick — button is completely non-functional

No onClick prop is provided. Since FloatingFab renders a <button type="button">, clicking it silently does nothing. An inquiry/contact button with zero behavior is a broken user-facing feature.

🐛 Proposed fix — wire up a navigation or modal handler
+import { useRouter } from "next/navigation";
 // or pass a handler from a parent if this becomes a client component
 
-      <FloatingFab
-              iconSrc="/icons_calling.svg"
-              iconAlt="문의하기"
-      />
+      <FloatingFab
+        iconSrc="/icons_calling.svg"
+        iconAlt="문의하기"
+        onClick={() => { /* navigate to contact page or open modal */ }}
+      />

Note: since NewsDetailPage is an async server component, adding an onClick requires either extracting FloatingFab into a wrapper client component or converting the page to "use client".

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/app/`(main)/news/[id]/page.tsx around lines 163 - 166, The FloatingFab
instance in NewsDetailPage is rendered without an onClick handler, so the button
does nothing; fix by making the click behavior client-side: either extract the
FloatingFab usage into a small client wrapper component (e.g.,
NewsContactFabClient) or convert the page to a client component and pass an
onClick prop to FloatingFab that performs the desired action (navigate to
/contact, open a modal, or call router.push) and ensure FloatingFab remains a
button type="button". Update the NewsDetailPage render to use the new client
wrapper or pass the onClick prop to FloatingFab so the inquiry button becomes
functional.

</>
);
}
21 changes: 6 additions & 15 deletions src/app/(main)/news/page.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
import Image from "next/image";
import NewsList from "@/components/base-ui/News/news_list";
import TodayRecommendedBooks from "@/components/base-ui/News/today_recommended_books";
import FloatingFab from "@/components/base-ui/Float";

const DUMMY_NEWS = [
{
Expand Down Expand Up @@ -105,21 +106,11 @@ export default function NewsPage() {
<div className="w-full my-8 border-b-4 border-Gray-1"></div>

<TodayRecommendedBooks books={DUMMY_BOOKS} className="hidden d:flex" />
{/* 문의하기 */}
<button
type="button"
className="fixed bottom-21 right-4 t:bottom-8 t:right-8 z-[60] cursor-pointer hover:opacity-80 transition-opacity w-18 h-18 t:w-22 t:h-22"
aria-label="문의하기"
>
<Image
src="/inquiry.svg"
alt="문의하기"
width={88}
height={88}
className="w-full h-full"
priority
/>
</button>

<FloatingFab
iconSrc="/icons_calling.svg"
iconAlt="문의하기"
/>
Comment on lines +110 to +113
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Same broken "문의하기" FloatingFab — missing onClick here too

Identical to the issue in src/app/(main)/news/[id]/page.tsx: no onClick means clicking this inquiry button silently does nothing. Unlike the detail page, this is already a "use client" component, so an inline handler can be added directly.

🐛 Proposed fix
-      <FloatingFab
-        iconSrc="/icons_calling.svg"
-        iconAlt="문의하기"
-      />
+      <FloatingFab
+        iconSrc="/icons_calling.svg"
+        iconAlt="문의하기"
+        onClick={() => { /* e.g. router.push("/contact") or open modal */ }}
+      />
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
<FloatingFab
iconSrc="/icons_calling.svg"
iconAlt="문의하기"
/>
<FloatingFab
iconSrc="/icons_calling.svg"
iconAlt="문의하기"
onClick={() => { /* e.g. router.push("/contact") or open modal */ }}
/>
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/app/`(main)/news/page.tsx around lines 110 - 113, The FloatingFab
instance in page.tsx is missing an onClick handler so the "문의하기" button does
nothing; since this is already a "use client" component, add an onClick prop to
the FloatingFab (the same way you fixed it in news/[id]/page.tsx) that triggers
the inquiry action (e.g., open modal or navigate to contact) — locate the
FloatingFab usage and provide an inline handler function for onClick that calls
the existing inquiry/opening logic or dispatches the appropriate UI action.

</div>
);
}
Loading