nezha_domains

mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 09:40:12 +00:00

T

naibaandcloudcode 94b7deef24 fix(service): hide EnableShowInService=false services from sideband endpoints

GHSA-vrmh-5mmx-hjwx: GET /api/v1/server/:id/service and
GET /api/v1/service/:id/history both iterate the raw service list and
emit ServiceName / timing for any service that happens to monitor the
queried server, ignoring the owner's EnableShowInService=false flag.
Both routes are on optionalAuth, so unauthenticated visitors could
enumerate hidden services by name and timing.

Introduce userCanViewService(c, service):
- EnableShowInService=true     -> always visible
- admin                        -> always visible
- authenticated owner          -> visible (HasPermission)
- everyone else                -> hidden

getServiceHistory rejects unknown-or-invisible service with the same
'service not found' message so the endpoint cannot be used as an
oracle. listServerServices pre-filters the sorted service list.

Owners and admins keep their existing visibility into their own hidden
services.

Tests:
- TestUserCanViewServiceVisibleServiceIsPublic
- TestUserCanViewServiceHiddenServiceRejectsGuest
- TestUserCanViewServiceHiddenServiceRejectsForeignMember
- TestUserCanViewServiceHiddenServiceAllowsOwner
- TestUserCanViewServiceHiddenServiceAllowsAdmin

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

2026-05-26 03:59:59 +00:00

.devcontainer

ci: use go1.24 (#1012 )

2025-02-28 22:19:57 +08:00

.github

ci: free gitee release storage before uploads

2026-05-19 05:06:38 +00:00

cmd/dashboard

fix(service): hide EnableShowInService=false services from sideband endpoints

2026-05-26 03:59:59 +00:00

model

feat(jwt): server-side session table with keyId + obfuscated uid claims

2026-05-26 03:51:05 +00:00

pkg

feat(idcodec): add hashid obfuscation derived from jwt secret

2026-05-26 03:50:36 +00:00

proto

improve: geoip

2025-02-09 14:39:12 +08:00

script

feat: upgrade frontend

2025-03-22 22:44:25 +08:00

service

feat(jwt): server-side session table with keyId + obfuscated uid claims

2026-05-26 03:51:05 +00:00

.gitattributes

💄 UI: 前端优化调整

2021-01-30 11:22:59 +08:00

.gitignore

Refactor: Load UserTemplates from embedded yaml file (#575 )

2024-12-10 21:57:20 +08:00

.goreleaser.yml

feat(v2.0.0): tsdb (#1162 )

2026-02-15 13:13:33 +08:00

Dockerfile

fix: embed tzdata to correct container timezone (#1126 )

2025-10-03 09:33:12 +08:00

go.mod

feat(idcodec): add hashid obfuscation derived from jwt secret

2026-05-26 03:50:36 +00:00

go.sum

feat(idcodec): add hashid obfuscation derived from jwt secret

2026-05-26 03:50:36 +00:00

LICENSE

Create LICENSE

2021-03-22 17:41:38 +08:00

README.md

update contributors[no ci]

2026-05-22 23:55:19 +08:00

SECURITY.md

Update vulnerability reporting contact method

2026-05-22 22:58:18 +08:00

README.md

LOGO designed by 熊大 .

:trollface: Nezha Monitoring: Self-hostable, lightweight, servers and websites monitoring and O&M tool.

Supports monitoring system status, HTTP (SSL certificate change, upcoming expiration, expired), TCP, Ping and supports push alerts, run scheduled tasks and web terminal.

>> Telegram Channel: 哪吒监控（中文通知频道）
>> Telegram Group: Nezha Monitoring Global (English Only), 哪吒监控（中文群组）

>> Use Cases | 我们的用户 (Google)