sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
247 Commits 25 Branches 12 Tags
2439ed3e8517236a8970c88a19cb070419de507e
Commit Graph
3 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Krystie 2439ed3e85 DC-022: close 3 TOTP auth security holes 
1. /totp/recovery-info: was PUBLIC, leaking TOTP configuration status
   to unauthenticated attackers. Now requires valid session (401 otherwise).

2. /totp/check-session: had an unconditional bypass that returned
   authenticated:true whenever totpConfig.enabled was false. This let
   anyone reach authenticated endpoints without credentials.
   Now throws AuthenticationError instead.

3. /totp/setup: was unmetered despite generating secrets. Added 3/hour
   per-IP rate limit in addition to the existing global 10/15min limiter.

All changes verified live via https://status.sami:
- recovery-info unauth → 401 [DC-110] (was 200)
- check-session no cookie → 401 TOTP protection required (was 200)
- 4th setup attempt → 429 [DC-429]
 2026-07-01 03:09:33 -07:00
Krystie 69be51b8aa chore(release): bump to 1.14.6 — patched source
CI / Test & Lint (push) Has been cancelled
Details
CI / Security audit (push) Has been cancelled
Details 
Following DC-021 (commit 10f72af) which restored working require paths and
license-keygen.js, this commit bumps the version metadata so the next
release build publishes v1.14.6 instead of re-tagging v1.14.4.

The source is functionally v1.14.4 + fixes; the version bump tells the
updater we're ahead of upstream's broken v1.14.4.
 2026-07-01 00:55:13 -07:00
Krystie 10f72af959 fix(update): proper require path fixes + license-keygen restore for v1.14.4 compatibility
CI / Test & Lint (push) Has been cancelled
Details
CI / Security audit (push) Has been cancelled
Details 
v1.14.4 (commit d2a48b1) shipped with broken relative paths and missing
license-keygen.js module. This commit:

- server.js: 26 '../src/...' requires rewritten to './src/...' (server is
  at API root, must use ./src for files in src/)
- src/managers/license-manager.js: './license-keygen' rewritten to
  '../../license-keygen' (license-keygen.js lives at API root)
- src/docker/self-updater.js: './platform-paths' rewritten to
  '../../platform-paths' (platform-paths.js lives at API root)
- license-keygen.js: restored to root (was missing from v1.14.4 tarball)
- VERSION: bumped to d2a48b1-patched (matches upstream commit but with
  our fixes baked in)

Makes the v1.14.4 source buildable and runnable without external patches.
Companion to scripts/dashcaddy-post-deploy-patches.sh which applies these
fixes automatically during the host-side update flow.
 2026-07-01 00:32:23 -07:00