CRITICAL FIX: Prevents nodes.enc configuration from being permanently lost
when decryption fails due to encryption key regeneration or corruption.
Root Cause Analysis:
1. If .encryption.key is deleted/regenerated, existing .enc files become unreadable
2. Previous code would fail to decrypt, try backup (also fails), then return error
3. This left NO nodes.enc file on disk
4. Next startup would see no .enc files and happily generate a new encryption key
5. User's node configuration was permanently lost
Changes Made:
1. **persistence.go (lines 600-645)**: When decryption fails for BOTH main file
and backup, instead of returning error and leaving no file:
- Log CRITICAL error with clear message about encryption key issue
- Move corrupted file to timestamped .corrupted file for forensics
- Create EMPTY but VALID encrypted nodes.enc file
- Return empty config so system can start
- This prevents encryption key regeneration on next startup
2. **crypto.go (lines 93-121)**: Enhanced encryption key generation checks:
- Now checks for nodes.enc* (including .backup, .corrupted files)
- Uses glob patterns to find ANY encrypted file remnants
- Refuses to generate new key if ANY .enc* files exist
- Provides clear error message listing all found files
- Forces manual intervention before allowing key regeneration
Benefits:
- System can still start even if decryption fails
- Corrupted files are preserved with timestamps for forensic analysis
- Encryption key cannot be silently regenerated if ANY encrypted data exists
- Clear, prominent error logging helps diagnose the root cause
- User is forced to manually address the issue rather than silently losing data
This should prevent the recurring issue where node configurations mysteriously
disappear, requiring manual reconfiguration through the UI.
addresses data loss issue where encryption key regeneration silently
orphaned all encrypted configuration (nodes, email, webhooks).
Changes:
- Check for existing .enc files before generating new encryption key
- Refuse to start if encrypted data exists but key is missing/invalid
- Forces explicit user action (restore key backup or delete .enc files)
- Prevents silent data loss from key regeneration
This ensures encrypted data is never accidentally orphaned when the
encryption key is lost or corrupted.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Security Fixes:
- Fix path traversal vulnerability in tar extraction (HIGH)
- Validate and sanitize paths from tar archives
- Prevent directory traversal attacks via ../
- Ensure extracted files stay within destination directory
- Remove weak SHA-256 password hashing code (MEDIUM)
- Removed unused SHA-256 hash function from crypto package
- All password hashing now uses bcrypt (cost 12) exclusively
- Added warning comment about proper password hashing
- Fix error information leakage (MEDIUM)
- Add sanitizeErrorMessage helper function
- Log detailed errors internally while returning generic messages
- Prevent exposure of system internals in error responses
- Change default CORS from * to restrictive (MEDIUM)
- Default to no CORS headers (same-origin only)
- Allow localhost origins only in development mode
- Require explicit configuration for production CORS
These fixes address all critical and medium severity issues found
in the security audit while maintaining backward compatibility.
- Detect public vs private network access
- Show stronger warnings for public access without auth
- Red banner when accessed from internet without authentication
- Support for trusted networks configuration via PULSE_TRUSTED_NETWORKS
- Automatic RFC1918 private IP detection
- Enhanced security status API with network context
- Added debug logging for encryption key loading
- Use consistent utils.GetDataDir() helper instead of duplicating logic
- Handle migration failures gracefully - log warnings but continue using old key
- Add detailed logging for migration with source and destination paths
- Prevent unnecessary migration when paths are identical
- Improve error messages for debugging
Addresses review feedback on the Docker persistence fix
- Move encryption key from /etc/pulse to PULSE_DATA_DIR (/data in Docker)
- Add automatic migration for existing installations
- Key now persists across container restarts when using volume mount
- Maintains backward compatibility for non-Docker installations
Fixes#290 reported by da99Beast where Docker containers lost
configuration on restart due to encryption key being regenerated
- Fix Gmail email configuration (field mapping between frontend/backend)
- Implement proper AES-256-GCM encryption for sensitive config files
- Add responsive column hiding for Storage tab on mobile devices
- Fix email configuration persistence and auto-populate recipients
- Add comprehensive testing tools for UI and API validation
- Fix alert acknowledge/clear functionality returning 404 errors
- Improve mobile UX: Storage shows only essential columns on small screens
- Revert dashboard to consistent table view (removed card layout experiment)
- Fix various UI issues: threshold detection, email template spacing
- Update notification system to use actual node data in test emails
rcourtman