mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-10 09:35:39 +00:00
Knienartowicz
8da6f8c9fd
Critical: - C-01: WebSocket Origin validation (CSWSH protection) via new middleware/wsOrigin.js, applied to wsRelay, chatRelay, remoteRelay, bdRelay, cdapTerminalProxy, cdapMediaProxy - C-02: Remove Tauri Origin-based CSRF bypass in server.js; only /api/bd/* skipped - C-03: Update vulnerable deps (express 4.21.2, multer 2.0.0, protobufjs 7.4.0, helmet 7.2.0, axios 1.9.0, cookie-parser 1.4.7, express-session 1.18.1) High: - H-01: Disable auto-create-local-user on login by default; opt-in via BETTERDESK_AUTH_AUTOCREATE=true (does not affect ensureDefaultAdmin fresh-install bootstrap) - H-02: Bearer-only auth for /api/bd/*; session cookie fallback removed; tokens redacted in logs - H-05: Replace custom PBKDF2 with golang.org/x/crypto/pbkdf2; 600k iterations; new format pbkdf2-sha256\\\ with backward-compat for legacy salt:hash Backward compatibility: legacy password hashes still verify; CSRF tokens still obtainable via csrfTokenProvider; fresh-install admin bootstrap (.admin_credentials flow) unchanged. Audit report: docs/security/AUDIT_PRODUCTION_2026-04-10.md This commit was made possible thanks to Insolve.
58 lines
1.4 KiB
JSON
58 lines
1.4 KiB
JSON
{
|
|
"name": "betterdesk-console",
|
|
"version": "2.3.0",
|
|
"description": "BetterDesk Console - Professional Web Management Panel for RustDesk Server",
|
|
"main": "server.js",
|
|
"scripts": {
|
|
"start": "node server.js",
|
|
"dev": "node --watch server.js",
|
|
"test": "jest --detectOpenHandles --forceExit",
|
|
"test:ci": "jest --detectOpenHandles --forceExit --ci",
|
|
"i18n:check": "node scripts/i18n-check.js",
|
|
"i18n:fix": "node scripts/i18n-check.js --fix"
|
|
},
|
|
"keywords": [
|
|
"rustdesk",
|
|
"betterdesk",
|
|
"remote-desktop",
|
|
"management-console"
|
|
],
|
|
"author": "UNITRONIX",
|
|
"license": "Apache-2.0",
|
|
"dependencies": {
|
|
"axios": "^1.9.0",
|
|
"bcrypt": "^5.1.1",
|
|
"better-sqlite3": "^11.3.0",
|
|
"cookie-parser": "^1.4.7",
|
|
"csrf-csrf": "^3.0.6",
|
|
"ejs": "^3.1.10",
|
|
"express": "^4.21.2",
|
|
"express-rate-limit": "^7.4.1",
|
|
"express-session": "^1.18.1",
|
|
"helmet": "^7.2.0",
|
|
"multer": "^2.0.0",
|
|
"otplib": "^12.0.1",
|
|
"protobufjs": "^7.4.0",
|
|
"qrcode": "^1.5.4",
|
|
"tweetnacl": "^1.0.3",
|
|
"tweetnacl-util": "^0.15.1",
|
|
"ws": "^8.19.0"
|
|
},
|
|
"optionalDependencies": {
|
|
"pg": "^8.13.0",
|
|
"node-pty": "^1.0.0"
|
|
},
|
|
"overrides": {
|
|
"tar": "^7.5.11",
|
|
"path-to-regexp": "^0.1.13",
|
|
"brace-expansion": "^1.1.13"
|
|
},
|
|
"devDependencies": {
|
|
"jest": "^29.7.0",
|
|
"supertest": "^7.2.2"
|
|
},
|
|
"engines": {
|
|
"node": ">=18.0.0"
|
|
}
|
|
}
|