4 Commits

Include renames

Author	SHA1	Message	Date
Hermes	320f21c113	fix: credential-manager and crypto-utils auto-resolve data directory paths ... The CREDENTIALS_FILE and ENCRYPTION_KEY_FILE env vars defaulted to __dirname/credentials.json and __dirname/.encryption-key, which works for the standard install (where individual files are mounted to /app/) but breaks for deployments using a consolidated data directory at /app/data/. Add resolveCredentialsFile() and resolveKeyFile() helpers that: 1. Honor explicit env var if set 2. Check /app/credentials.json and /app/data/credentials.json 3. Check /app/.encryption-key and /app/data/.encryption-key 4. Default to standard path for new installs This makes DashCaddy deployable with either pattern without requiring custom env var configuration, which is essential for general-public reproducibility.	2026-06-10 19:05:07 -07:00
SamiandClaude Opus 4.6	59b6d7d360	Fix 16 HIGH/MEDIUM security bugs across API ... HIGH fixes: - TOTP disable now requires valid code verification - TOTP secret removed from plaintext file storage - Container ID validated before update/check-update/logs operations - DNS server parameter restricted to configured servers (SSRF prevention) - Backup export no longer includes encryption key - Backup restore of sensitive files requires TOTP re-authentication MEDIUM fixes: - Session cookie Secure flag added - Caddy reload errors no longer leaked to client - saveConfig uses atomic locked updates via configStateManager - Log file path traversal prevented via symlink resolution - Credential cache entries now expire after 5 minutes - _httpFetch enforces 10MB response size limit - External URL path injection into Caddyfile blocked - Custom volume host paths validated against allowed roots - Error logs endpoint no longer returns stack traces - Logo delete path traversal prevented via path.basename() Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 00:15:28 -08:00
SamiandClaude Opus 4.6	6979302fb7	Fix 7 critical security bugs and 1 high-severity data loss bug ... - CSRF: HMAC-signed double-submit cookie (server-bound, not raw compare) - Keychain: execFileSync with arg arrays to prevent command injection - Caddy config: always use structured generation, never accept raw config - Templates: replace {{GENERATED_SECRET}} with crypto.randomBytes - Caddyfile removal: move regex inside ctx.caddy.modify() to fix TOCTOU race - Credentials: proper-lockfile for all file operations, fix key rotation to decrypt with old key before generating new key - Service removal: filter by ID only, not AND with appTemplate Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-06 23:08:30 -08:00
Sami	f61e85d9a7	Initial commit: DashCaddy v1.0 ... Full codebase including API server (32 modules + routes), dashboard frontend, DashCA certificate distribution, installer script, and deployment skills.	2026-03-05 02:26:12 -08:00