nezha_domains

mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 09:40:12 +00:00

T

naibaandnaiba/CloudCode 7c493e8f0b fix(rpc): verify gRPC client UUID belongs to the agent secret owner

Auth.Check resolved client_uuid → server.ID via UUIDToID without
checking that the resolved server's UserID matched the user that the
secret was bound to. An agent presenting one user's secret could
target a different user's server UUID and impersonate it — poisoning
monitoring state, triggering alerts, or quietly receiving tasks the
real owner expected.

Add authorizeAgentForUUID: if the UUID is unknown we still allow new
registration bound to the secret owner; if the UUID is known but
points to someone else's server we reject. The rejection message
"client UUID does not belong to the agent secret owner" also helps
operators trace which user's secret has leaked.

Note: this changes runtime behaviour after batch-move/server — the
new owner must reconfigure agents with their own secret. That is the
correct contract; the previous behaviour was a cross-user reporting
bug.

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>

2026-05-18 15:17:37 +00:00

.devcontainer

ci: use go1.24 (#1012 )

2025-02-28 22:19:57 +08:00

.github

chore: bump Go to 1.26, update dependencies and frontend templates

2026-03-20 11:23:03 +00:00

cmd/dashboard

fix(controller): hide foreign server IDs from forceUpdateServer response

2026-05-18 15:16:59 +00:00

model

fix(ddns): apply SSRF defense to webhook provider

2026-05-18 15:14:27 +00:00

pkg

fix(ddns): apply SSRF defense to webhook provider

2026-05-18 15:14:27 +00:00

proto

improve: geoip

2025-02-09 14:39:12 +08:00

script

feat: upgrade frontend

2025-03-22 22:44:25 +08:00

service

fix(rpc): verify gRPC client UUID belongs to the agent secret owner

2026-05-18 15:17:37 +00:00

.gitattributes

💄 UI: 前端优化调整

2021-01-30 11:22:59 +08:00

.gitignore

Refactor: Load UserTemplates from embedded yaml file (#575 )

2024-12-10 21:57:20 +08:00

.goreleaser.yml

feat(v2.0.0): tsdb (#1162 )

2026-02-15 13:13:33 +08:00

Dockerfile

fix: embed tzdata to correct container timezone (#1126 )

2025-10-03 09:33:12 +08:00

go.mod

chore(deps): upgrade go modules to latest

2026-05-17 02:40:09 +00:00

go.sum

chore(deps): upgrade go modules to latest

2026-05-17 02:40:09 +00:00

LICENSE

Create LICENSE

2021-03-22 17:41:38 +08:00

README.md

update contributors[no ci]

2026-03-01 11:33:11 +08:00

SECURITY.md

Create SECURITY.md [skip ci]

2022-04-18 10:47:29 +08:00

README.md

LOGO designed by 熊大 .

:trollface: Nezha Monitoring: Self-hostable, lightweight, servers and websites monitoring and O&M tool.

Supports monitoring system status, HTTP (SSL certificate change, upcoming expiration, expired), TCP, Ping and supports push alerts, run scheduled tasks and web terminal.

>> Telegram Channel: 哪吒监控（中文通知频道）
>> Telegram Group: Nezha Monitoring Global (English Only), 哪吒监控（中文群组）

>> Use Cases | 我们的用户 (Google)