Andras Bacsai
922884e6d3
feat: implement TrustHosts middleware to handle FQDN and IP address trust logic
...
This commit fixes a critical Host Header Injection vulnerability in the password reset flow that could lead to account takeover.
Security Issue:
- Attackers could inject malicious host headers (e.g., legitimate.domain.evil.com)
- Password reset emails would contain links to attacker-controlled domains
- Attackers could capture reset tokens and takeover accounts
Changes:
- Enable TrustHosts middleware in app/Http/Kernel.php
- Update TrustHosts to trust configured FQDN from InstanceSettings
- Add intelligent caching (5-min TTL) to avoid DB query on every request
- Automatic cache invalidation when FQDN is updated
- Support for domains, IP addresses (IPv4/IPv6), and ports
- Graceful fallback during installation when DB doesn't exist
Test Coverage:
- Domain validation (with/without ports)
- IP address validation (IPv4, IPv6)
- Malicious host rejection
- Cache creation and invalidation
- Installation edge cases
Performance:
- 99.9% reduction in DB queries (1 query per 5 minutes vs every request)
- Zero performance impact on production workloads
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-15 22:00:21 +02:00
Andras Bacsai
eecf22f6a5
feat: implement TrustHosts middleware to handle FQDN and IP address trust logic
2025-10-15 15:28:21 +02:00
Andras Bacsai
a7671ed379
refactor(dns-validation): rename DNS validation functions for consistency and clarity, and remove unused code
2025-09-09 09:00:35 +02:00
Andras Bacsai
643343785a
refactor(auth): simplify access control logic in CanAccessTerminal and ServerPolicy by allowing all users to perform actions
2025-08-28 10:48:24 +02:00
Andras Bacsai
63fcc0ebc3
feat(acl): Change views/backend code to able to use proper ACL's later on. Currently it is not enabled.
2025-08-26 10:27:38 +02:00
Andras Bacsai
74ebaef17b
feat(api): enhance IP access control in middleware and settings; support CIDR notation and special case for 0.0.0.0 to allow all IPs
2025-08-26 10:27:38 +02:00
Andras Bacsai
3e1f47a243
feat(auth): introduce resource creation authorization middleware and policies for enhanced access control
2025-08-26 10:27:38 +02:00
Rado
00225a9eff
fix(webhooks): exclude webhook routes from CSRF protection ( #6200 )
2025-07-18 19:04:08 +02:00
Andras Bacsai
3fa7d03db7
fix: root + read:sensive could read senstive data with a middlewarew
2024-12-09 11:10:35 +01:00
Andras Bacsai
ff74fb7385
feat: introduce root permission
2024-12-09 10:52:38 +01:00
Andras Bacsai
5bbcd7bf76
fix: add middleware to new abilities, better ux for selecting permissions, etc.
2024-12-09 10:28:34 +01:00
Kael
6520235667
middleware should allow, not deny
2024-10-30 19:06:50 +11:00
Lucas Michot
d557a22b91
Remove all ray() calls
2024-10-28 13:51:23 +01:00
Andras Bacsai
83549965ca
Refactor instanceSettings() function for improved code readability
2024-10-01 10:37:40 +02:00
Andras Bacsai
0f55e83591
revert: instancesettings
2024-07-12 15:45:36 +02:00
andrasbacsai
fa895db76e
Fix styling
2024-07-12 10:53:07 +00:00
Andras Bacsai
88f33be5b6
refactor: only get instanceSettings once from db
2024-07-12 12:51:55 +02:00
Andras Bacsai
b24a489c77
fix: api updates
2024-07-03 13:13:38 +02:00
Andras Bacsai
4459c9f73d
feat: api api api api api api
2024-07-02 16:12:04 +02:00
Andras Bacsai
c39d6dd407
feat: token permissions
...
feat: handle sensitive data
feat: handle read-only data
2024-07-02 12:15:58 +02:00
Andras Bacsai
da6f2da3d0
feat: lots of api endpoints
2024-07-01 16:26:50 +02:00
Thijmen
d86274cc37
Fix styling
2024-06-10 20:43:34 +00:00
Andras Bacsai
6cb3df9350
rename boarding to onboarding
2024-03-13 12:11:37 +01:00
Andras Bacsai
2ffc3f497b
fix: should note delete personal teams
2024-03-05 09:19:15 +01:00
Andras Bacsai
65fcaa17d9
Update exception in PreventRequestsDuringMaintenance middleware and version numbers
2024-03-04 11:41:02 +01:00
Andras Bacsai
54923b7640
feat: collect webhooks during maintenance
2024-03-01 14:04:29 +01:00
Andras Bacsai
3b942049a2
Refactor subscription handling logic in middleware and model
2024-02-23 13:50:48 +01:00
Andras Bacsai
32dbdf5204
Fix redirect route in DecideWhatToDoWithUser middleware
2023-12-28 22:26:21 +01:00
Andras Bacsai
5596e41f2b
fix: sub
2023-12-28 13:43:03 +01:00
Andras Bacsai
f03aa57758
fix: routing, switch back to old one
2023-12-27 16:45:01 +01:00
Andras Bacsai
02c8b9f471
fix: password reset / invitation link requests
2023-12-13 15:22:37 +01:00
Andras Bacsai
3c54e01d87
improve more
2023-12-13 11:35:53 +01:00
Andras Bacsai
928345c8ea
fix: force password reset on invited accounts
2023-10-26 20:45:38 +02:00
Andras Bacsai
62adf2c5dc
fix: boarding + verification
2023-10-11 14:24:19 +02:00
Andras Bacsai
5cea9c4603
isInstanceAdmin()
2023-10-09 14:38:44 +02:00
Andras Bacsai
d32832fabc
update
2023-10-09 14:32:30 +02:00
Andras Bacsai
165f0a3d4a
feat: add email verification for cloud
2023-10-09 14:20:55 +02:00
Andras Bacsai
b07cc500e7
fix: invitation
2023-09-15 11:19:36 +02:00
Andras Bacsai
b7786504b8
wip: nixpacksarchive
2023-09-11 15:53:05 +02:00
Andras Bacsai
45b597bbab
feat: cache team settings
2023-09-08 18:33:26 +02:00
Andras Bacsai
f6737f21dd
feat: developer view for env variables
2023-09-08 16:16:59 +02:00
Andras Bacsai
e7c0c26b32
fix: stripe
...
add: custom error pages
fix: invititation
feat: new quick login for first users (UX++)
feat: more internal notifications
2023-09-06 12:07:34 +02:00
Andras Bacsai
87dd819ae4
fix: password confirmation
2023-08-31 09:56:37 +02:00
Andras Bacsai
5b6667c461
refactor + fixes
2023-08-30 16:01:38 +02:00
Andras Bacsai
291b9a84ef
refactoring
2023-08-29 14:36:17 +02:00
Andras Bacsai
2f9b7b188a
ui update
2023-08-29 10:11:18 +02:00
Andras Bacsai
d04d41bc23
update dockercleanupjob
2023-08-29 10:00:29 +02:00
Andras Bacsai
ba39f2595c
update
2023-08-24 20:49:54 +02:00
Andras Bacsai
9ef3218bb5
updates
2023-08-24 17:41:11 +02:00
Andras Bacsai
39890b319a
add stripe subscription
2023-08-24 16:14:09 +02:00
