mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-10 17:45:42 +00:00
UNITRONIX
5b4408a190
Security hardening and installer fixes across the Go API, installers and Node console. Key changes: - WebSocket: removed InsecureSkipVerify and added API_WS_ALLOWED_ORIGINS allowlist (parsed in config) used by the API events WS endpoint. - Node.js console: added HOST and API_HOST envs and used apiHost in the server; docker-compose and installer templates updated accordingly. - Admin credentials: plaintext .admin_credentials persistence is now opt-in via STORE_ADMIN_CREDENTIALS (default false); installers and reset flows no longer persist creds unless explicitly enabled. - Installer hardening: added sql_escape_literal for safe SQL literals, PostgreSQL identifier validation, and safer CREATE/ALTER/psql invocations; API key and password updates now pass secrets via environment variables to Python/Node fallbacks to avoid unsafe shell interpolation. - Docker compose/scripts: preserve_compose_database_config to keep DB mode during regen, escaped API key insertion into sqlite, and various compose generation formatting fixes. - Go toolchain & checks: go.mod toolchain set to go1.26.1 and installers now reject known-vulnerable Go 1.26.0 stdlib. - Dependency: bumped web-nodejs tar override to ^7.5.11. These changes reduce attack surface for cross-origin WS usage, eliminate unsafe credential persistence by default, and harden installer DB operations and password reset paths.
47 lines
1.0 KiB
JSON
47 lines
1.0 KiB
JSON
{
|
|
"name": "betterdesk-console",
|
|
"version": "2.3.0",
|
|
"description": "BetterDesk Console - Professional Web Management Panel for RustDesk Server",
|
|
"main": "server.js",
|
|
"scripts": {
|
|
"start": "node server.js",
|
|
"dev": "node --watch server.js"
|
|
},
|
|
"keywords": [
|
|
"rustdesk",
|
|
"betterdesk",
|
|
"remote-desktop",
|
|
"management-console"
|
|
],
|
|
"author": "UNITRONIX",
|
|
"license": "Apache-2.0",
|
|
"dependencies": {
|
|
"axios": "^1.7.7",
|
|
"bcrypt": "^5.1.1",
|
|
"better-sqlite3": "^11.3.0",
|
|
"cookie-parser": "^1.4.6",
|
|
"csrf-csrf": "^3.0.6",
|
|
"ejs": "^3.1.10",
|
|
"express": "^4.18.2",
|
|
"express-rate-limit": "^7.4.1",
|
|
"express-session": "^1.18.0",
|
|
"helmet": "^7.1.0",
|
|
"multer": "^1.4.5-lts.1",
|
|
"otplib": "^12.0.1",
|
|
"protobufjs": "^8.0.0",
|
|
"qrcode": "^1.5.4",
|
|
"tweetnacl": "^1.0.3",
|
|
"tweetnacl-util": "^0.15.1",
|
|
"ws": "^8.19.0"
|
|
},
|
|
"optionalDependencies": {
|
|
"pg": "^8.13.0"
|
|
},
|
|
"overrides": {
|
|
"tar": "^7.5.11"
|
|
},
|
|
"engines": {
|
|
"node": ">=18.0.0"
|
|
}
|
|
}
|