From d463b3df5ca6c12e5ff421c392e223d095f7a187 Mon Sep 17 00:00:00 2001
From: DebaucheryLibrarian <DebaucheryLibrarian@unknown.name>
Date: Wed, 20 May 2026 17:53:38 +0200
Subject: [PATCH 1/2] Added guards for stash operations with missing arguments.

---
 src/stashes.js | 64 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)

diff --git a/src/stashes.js b/src/stashes.js
index dcc18da..6a93f88 100755
--- a/src/stashes.js
+++ b/src/stashes.js
@@ -200,6 +200,10 @@ export async function createStash(newStash, sessionUser) {
 		throw new HttpError('You are not authenthicated', 401);
 	}
 
+	if (!newStash) {
+		throw new HttpError('Missing new stash', 400);
+	}
+
 	verifyStashName(newStash);
 
 	try {
@@ -224,6 +228,14 @@ export async function updateStash(stashIdOrSlug, updatedStash, sessionUser) {
 		throw new HttpError('You are not authenthicated', 401);
 	}
 
+	if (!stashIdOrSlug) {
+		throw new HttpError('Missing stash ID or slug', 400);
+	}
+
+	if (!updatedStash) {
+		throw new HttpError('Missing updated stash', 400);
+	}
+
 	if (updatedStash.name) {
 		verifyStashName(updatedStash);
 	}
@@ -260,6 +272,10 @@ export async function removeStash(stashId, sessionUser) {
 		throw new HttpError('You are not authenthicated', 401);
 	}
 
+	if (!stashId) {
+		throw new HttpError('Missing stash ID', 400);
+	}
+
 	const stash = await fetchStashById(stashId, sessionUser);
 
 	if (!stash) {
@@ -283,6 +299,14 @@ export async function removeStash(stashId, sessionUser) {
 }
 
 export async function stashActor(actorId, stashId, sessionUser) {
+	if (!actorId) {
+		throw new HttpError('Missing actor ID', 400);
+	}
+
+	if (!stashId) {
+		throw new HttpError('Missing stash ID', 400);
+	}
+
 	const stash = await fetchStashById(stashId, sessionUser);
 
 	if (!stash) {
@@ -324,6 +348,14 @@ export async function stashActor(actorId, stashId, sessionUser) {
 }
 
 export async function unstashActor(actorId, stashId, sessionUser) {
+	if (!actorId) {
+		throw new HttpError('Missing actor ID', 400);
+	}
+
+	if (!stashId) {
+		throw new HttpError('Missing stash ID', 400);
+	}
+
 	const stash = await fetchStashById(stashId, sessionUser);
 
 	if (!stash) {
@@ -367,6 +399,14 @@ export async function unstashActor(actorId, stashId, sessionUser) {
 }
 
 export async function stashScene(sceneId, stashId, sessionUser) {
+	if (!sceneId) {
+		throw new HttpError('Missing scene ID', 400);
+	}
+
+	if (!stashId) {
+		throw new HttpError('Missing stash ID', 400);
+	}
+
 	const stash = await fetchStashById(stashId, sessionUser);
 
 	if (!stash) {
@@ -409,6 +449,14 @@ export async function stashScene(sceneId, stashId, sessionUser) {
 }
 
 export async function unstashScene(sceneId, stashId, sessionUser) {
+	if (!sceneId) {
+		throw new HttpError('Missing scene ID', 400);
+	}
+
+	if (!stashId) {
+		throw new HttpError('Missing stash ID', 400);
+	}
+
 	const stash = await fetchStashById(stashId, sessionUser);
 
 	if (!stash) {
@@ -448,6 +496,14 @@ export async function unstashScene(sceneId, stashId, sessionUser) {
 }
 
 export async function stashMovie(movieId, stashId, sessionUser) {
+	if (!movieId) {
+		throw new HttpError('Missing movie ID', 400);
+	}
+
+	if (!stashId) {
+		throw new HttpError('Missing stash ID', 400);
+	}
+
 	const stash = await fetchStashById(stashId, sessionUser);
 
 	if (!stash) {
@@ -489,6 +545,14 @@ export async function stashMovie(movieId, stashId, sessionUser) {
 }
 
 export async function unstashMovie(movieId, stashId, sessionUser) {
+	if (!movieId) {
+		throw new HttpError('Missing movie ID', 400);
+	}
+
+	if (!stashId) {
+		throw new HttpError('Missing stash ID', 400);
+	}
+
 	const stash = await fetchStashById(stashId, sessionUser);
 
 	if (!stash) {

From e3171e56937366bea070575b7fdbe08ad3755af4 Mon Sep 17 00:00:00 2001
From: DebaucheryLibrarian <DebaucheryLibrarian@unknown.name>
Date: Wed, 20 May 2026 17:53:40 +0200
Subject: [PATCH 2/2] 0.49.8

---
 package-lock.json | 4 ++--
 package.json      | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e404d7a..78a87db 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,11 +1,11 @@
 {
   "name": "traxxx-web",
-  "version": "0.49.7",
+  "version": "0.49.8",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
-      "version": "0.49.7",
+      "version": "0.49.8",
       "dependencies": {
         "@brillout/json-serializer": "^0.5.8",
         "@dicebear/collection": "^7.0.5",
diff --git a/package.json b/package.json
index dc434b8..7f64b0c 100644
--- a/package.json
+++ b/package.json
@@ -92,7 +92,7 @@
   "overrides": {
     "vite": "$vite"
   },
-  "version": "0.49.7",
+  "version": "0.49.8",
   "imports": {
     "#/*": "./*.js"
   }