5 Commits

Include renames

Author	SHA1	Message	Date
Hermes	1fbe65f524	Standardize paths, add version endpoint, request timeouts, HOST env var, graceful shutdown ... Cross-platform hardening — removes all hardcoded /app/ paths from route files and routes them through platform-paths.js so the app works the same way regardless of Docker layout (single-file mount vs consolidated data dir). Changes: - platform-paths.js: add generatedCertsDir, pkiDir, containerUpdatesDir, containerFrontendDir, containerAssetsDir, resolveAssetsPath() - self-updater.js: UPDATE_URL/MIRROR_URL/CHANNEL env var overrides - routes/ca.js: use platformPaths for cert paths and generated certs dir - routes/services.js: use platformPaths.pkiRootCert - routes/themes.js: derive THEMES_DIR from platformPaths.servicesFile - routes/config/assets.js + backup.js: use resolveAssetsPath() fallback - routes/services.js + src/app.js: use platformPaths.pkiRootCert - server.js: HOST env var support, parse PORT as int - src/app.js: GET /api/v1/version (public, no auth), global request timeout, disable x-powered-by, trust proxy - pylon/dashcaddy-pylon.js: PYLON_HOST env var, graceful shutdown on SIGTERM/SIGINT A fresh user can now deploy with a custom Docker layout (e.g. /opt/dc/data/ as a single volume mount) and the app finds its files automatically, no env var configuration required.	2026-06-10 19:36:05 -07:00
Hermes	17edb3bc90	Fix 5 critical security vulnerabilities ... 1. WebSocket exec auth bypass (exec.js): Require valid JWT or API key before accepting WebSocket upgrade. Reject unauthenticated requests with 401 before the upgrade completes. 2. Shell injection in router auto-login (session-handlers.js): Validate baseUrl against safe hostname pattern before embedding in wget shell command. Reject with null session if invalid. 3. Path traversal in credentials routes (services.js): Add explicit serviceId validation (alphanumeric + dash/underscore/dot, max 100 chars) to all three credential endpoints. Removed redundant try/catch wrapper. 4. execSync injection in CA CSR generation (ca.js): Add sanitize step replacing any non-alphanumeric domain chars with underscore before interpolation into shell subj argument. Redundant with existing validation but provides defense-in-depth. 5. Auth bypass when TOTP disabled (middleware.js): Split the logic cleanly — disabled TOTP means no auth (initial setup state), enabled TOTP means all auth methods checked (session/JWT/API key). Removed the sessionDuration:never conflating shortcut.	2026-05-27 18:05:35 -07:00
Krystie	0c658a26a8	fix(routes): complete post-refactor dependency wiring cleanup	2026-05-04 16:44:18 -07:00
Krystie	b172a21b63	Migrate 25 route files to throw-based error handling ... Converted routes: - All auth routes (totp.js, keys.js, sso-gate.js) - Recipe deployment routes (deploy.js, manage.js, index.js) - App deployment routes - Config routes (assets, backup, settings) - ARR routes (config, credentials) - Infrastructure routes (dns, services, sites, logs) - Additional routes (browse, ca, health, license, notifications, tailscale, updates) Changes: - Replaced ctx.errorResponse() with throw statements - Replaced errorResponse() with throw statements - Added proper error imports to each file - 400 errors → ValidationError - 401 errors → AuthenticationError - 403 errors → ForbiddenError - 404 errors → NotFoundError - 409 errors → ConflictError - 500 errors → Handled by middleware Result: 25 files migrated, ~150 error responses standardized	2026-03-29 18:53:03 -07:00
Sami	f61e85d9a7	Initial commit: DashCaddy v1.0 ... Full codebase including API server (32 modules + routes), dashboard frontend, DashCA certificate distribution, installer script, and deployment skills.	2026-03-05 02:26:12 -08:00