29d03492fb
fix(installer): harden cross-platform lifecycle reliability
...
Harden native, agent and Docker lifecycle paths with tracked update verification, rollback and preflight checks, safe uninstall semantics, and health verification. Add shared protocol tests, installer CI gates, and lifecycle documentation.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
2026-08-15 21:50:47 +02:00
aea7b30b29
fix(security): enhance path validation and rate limiting for file access
...
Updated CodeQL configuration to exclude additional paths for security checks. Introduced a new file access rate limiter to prevent abuse of file download endpoints. Improved path resolution functions to ensure confined access and added validation in body scalar functions to reject non-scalar types. Enhanced error handling in API endpoint validation to prevent invalid inputs.
2026-06-11 18:33:14 +02:00
c2e0e2e784
fix(security): harden CodeQL findings across console and Go server
...
Address GitHub code scanning alerts with OIDC SSRF guards, confined path
helpers, safer client routing, branding sanitization, upload rate limits,
and CodeQL config exclusions for dev-only and protocol-intentional hashes.
2026-06-11 06:57:58 +02:00
9b02f06465
fix(security): phase-C XSS hardening, path confinement, log redaction
...
Harden backup restore, theme/attachment paths, frontend escaping, and
sensitive logging without changing normal operator workflows.
2026-06-09 03:00:43 +02:00
7b938d8c7b
fix(security): harden path confinement, SSRF, and shell exec
...
Add shared safePath helper for file browser, i18n, and backup paths;
use validated OIDC discovery URLs; restrict terminal shells and
network monitor HTTP requests. Remove obsolete one-time i18n migration
scripts already merged into lang/*.json.
2026-06-09 02:21:43 +02:00
UNITRONIX