naibaandcloudcode 00fde59d4d fix(fm): switch create FM session to POST to defeat CSRF ...

GET /api/v1/file?id=<server> created an FM stream on the agent stream
and committed real state change (TaskTypeFM dispatched). With JWT
cookie SameSite=Lax a victim's browser would still send the cookie on
a top-level cross-site GET, so an attacker could trick a logged-in
user into opening an FM session on any of their own servers, consuming
resources and triggering the agent's FM machinery without consent.

Mirror the GHSA-8qhj-4f8c-j8qg fix: move the route to POST. SameSite=
Lax cookies are not sent on cross-site POST. Frontend (admin-frontend)
adjusted in a follow-up commit.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

2026-05-26 04:07:49 +00:00

..

waf

fix: add a default error message for waf page (#1145)

2025-12-04 21:52:12 +08:00

alertrule.go

fix(controller): enforce ownership on notification group, NAT server, and batch move

2026-05-17 10:24:19 +08:00

controller.go

fix(fm): switch create FM session to POST to defeat CSRF

2026-05-26 04:07:49 +00:00

cron_manual_csrf_test.go

fix(cron): switch manual trigger to POST to defeat CSRF

2026-05-26 03:59:50 +00:00

cron.go

fix(cron): switch manual trigger to POST to defeat CSRF

2026-05-26 03:59:50 +00:00

ddns.go

ddns: support provider hurricane electric (#1036)

2025-03-19 21:52:16 +08:00

fm.go

fix(fm): switch create FM session to POST to defeat CSRF

2026-05-26 04:07:49 +00:00

force_update_ownership_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

frontend_fallback_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

jwt_session_test.go

feat(jwt): server-side session table with keyId + obfuscated uid claims

2026-05-26 03:51:05 +00:00

jwt_test.go

test: cover multi-user permission boundaries

2026-05-17 10:24:19 +08:00

jwt.go

feat(jwt): server-side session table with keyId + obfuscated uid claims

2026-05-26 03:51:05 +00:00

nat.go

fix(controller): enforce ownership on notification group, NAT server, and batch move

2026-05-17 10:24:19 +08:00

notification_group.go

fix(controller): filter listing endpoints by ownership

2026-05-17 10:24:19 +08:00

notification.go

feat(notification): add option to convert metric units in request body (#1156)

2026-01-10 17:29:10 +08:00

oauth2.go

feat(jwt): server-side session table with keyId + obfuscated uid claims

2026-05-26 03:51:05 +00:00

permission_matrix_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

permissions.go

fix(service): hide EnableShowInService=false services from sideband endpoints

2026-05-26 03:59:59 +00:00

server_group.go

fix(controller): filter listing endpoints by ownership

2026-05-17 10:24:19 +08:00

server.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

service_visibility_test.go

fix(service): hide EnableShowInService=false services from sideband endpoints

2026-05-26 03:59:59 +00:00

service.go

fix(service): hide EnableShowInService=false services from sideband endpoints

2026-05-26 03:59:59 +00:00

setting.go

feat(v2.0.0): tsdb (#1162)

2026-02-15 13:13:33 +08:00

stream_ownership_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

terminal.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

transfer_list_filter_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

transfer_retry_authz_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

transfer.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

user.go

feat(jwt): server-side session table with keyId + obfuscated uid claims

2026-05-26 03:51:05 +00:00

waf.go

feat(waf): return ip in string literal (#947)

2025-01-04 20:49:14 +08:00

ws_stream_visibility_test.go

fix(ws): scope server stream visibility to viewer ownership

2026-05-17 03:41:28 +00:00

ws.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00