GL.iNet-Yongping.Xie 111ef8ea33 fix(api): check device access on connect/cmd/web ...

These routes only verified that a session existed, so any logged-in user
could drive any device by id, including ungrouped ones the device list
never showed them. Apply the same visibility rule as the list: admins
reach everything, a regular user only devices in a group linked to one
of their user groups. Denials answer with the error page, a bare 403 for
websocket upgrades, and err 1004 for /cmd.

Also drop the two shortcuts in httpAuth that skipped authentication when
no password was configured or when local-auth was off and the request
came from loopback -- behind a reverse proxy every request looks local.
Both settings now log a warning instead.

Signed-off-by: GL.iNet-Yongping.Xie <yongping.xie@gl-inet.com>

2026-10-14 00:38:46 -07:00

..

app

fix: optimize user deletion logic

2026-02-05 20:29:07 -08:00

config

fix: refactor legacy login endpoint

2026-01-19 02:15:07 -08:00

domain

feat(devices): add online/offline status filter to device list

2026-06-24 02:05:28 -07:00

http

fix(api): limit script-info to users who may add devices

2026-10-14 00:38:39 -07:00

legacy

perf(devices): minimal write on reconnect, skip unchanged client

2026-06-24 00:07:50 -07:00

pkg

feat: add personal center with TOTP 2FA and trusted devices

2026-04-06 21:17:44 -07:00

proxy

fix: remove unused legacy main entry

2026-01-21 02:33:41 -08:00

qa

test(qa): add group/RBAC visibility, event-log, and device CRUD e2e cases

2026-06-24 02:57:44 -07:00

server

fix(api): check device access on connect/cmd/web

2026-10-14 00:38:46 -07:00

store

feat(devices): add online/offline status filter to device list

2026-06-24 02:05:28 -07:00