4 Commits

Include renames

Author	SHA1	Message	Date
Hermes	11cfb8c26a	Consolidate response helpers and error logger to single modules ... Two cleanups in one pass for the v1.14.0 'works on any platform' theme: 1. Response helpers — merged src/utils/responses.js and the root-level response-helpers.js into a single module at src/utils/responses.js. The old module had a richer set (created, noContent, validationError, unauthorized, forbidden, notFound, conflict) and is now re-exported from the new location. Updated 15 routes to import from src/utils/responses and deleted the root response-helpers.js. 2. Error logger — error-handler.js now uses the unified src/utils/logging.js#logError (same one src/app.js uses), so all errors go to one log file with one rotation policy. Removed the dead asyncHandler export (the real one is in src/utils/async-handler.js and is used everywhere). Deleted the legacy error-logger.js. Both are invisible to users — same HTTP response shapes, same log file path, same error format. Internal-only refactor.	2026-06-10 21:37:55 -07:00
Krystie	51d6c37e4a	refactor(routes): Phase 3.6-10 - standardize 5 utility routes ... - credentials.js (2 deps: credentialManager, asyncHandler) - backups.js (2 deps: backupManager, asyncHandler) - license.js (2 deps: licenseManager, asyncHandler) - errorlogs.js (3 deps: ERROR_LOG_FILE, auditLogger, asyncHandler) - themes.js (0 deps! Standalone route) Total: 9 routes refactored so far	2026-03-28 19:32:01 -07:00
SamiandClaude Opus 4.6	59b6d7d360	Fix 16 HIGH/MEDIUM security bugs across API ... HIGH fixes: - TOTP disable now requires valid code verification - TOTP secret removed from plaintext file storage - Container ID validated before update/check-update/logs operations - DNS server parameter restricted to configured servers (SSRF prevention) - Backup export no longer includes encryption key - Backup restore of sensitive files requires TOTP re-authentication MEDIUM fixes: - Session cookie Secure flag added - Caddy reload errors no longer leaked to client - saveConfig uses atomic locked updates via configStateManager - Log file path traversal prevented via symlink resolution - Credential cache entries now expire after 5 minutes - _httpFetch enforces 10MB response size limit - External URL path injection into Caddyfile blocked - Custom volume host paths validated against allowed roots - Error logs endpoint no longer returns stack traces - Logo delete path traversal prevented via path.basename() Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 00:15:28 -08:00
Sami	f61e85d9a7	Initial commit: DashCaddy v1.0 ... Full codebase including API server (32 modules + routes), dashboard frontend, DashCA certificate distribution, installer script, and deployment skills.	2026-03-05 02:26:12 -08:00