naibaandcloudcode 9929e04643 fix(cron): switch manual trigger to POST to defeat CSRF ...

GHSA-8qhj-4f8c-j8qg: GET /api/v1/cron/:id/manual changed shared state
on the agent stream, and the JWT cookie is SameSite=Lax so a victim's
browser would send the cookie on a top-level cross-site GET. An
attacker could trick a logged-in user into firing any of their own
cron commands.

Switch the route to POST: SameSite=Lax cookies are not sent on cross-
site POST, closing the CSRF window without introducing a new token.

Tests:
- TestCronManualTriggerRejectsCrossSiteGET locks in that GET no longer
  resolves.
- TestCronManualTriggerAcceptsSameSitePOST locks in the legitimate POST
  still works.

Frontend (admin-frontend) updated in a follow-up commit.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

2026-05-26 03:59:50 +00:00

..

waf

fix: add a default error message for waf page (#1145)

2025-12-04 21:52:12 +08:00

alertrule.go

fix(controller): enforce ownership on notification group, NAT server, and batch move

2026-05-17 10:24:19 +08:00

controller.go

fix(cron): switch manual trigger to POST to defeat CSRF

2026-05-26 03:59:50 +00:00

cron_manual_csrf_test.go

fix(cron): switch manual trigger to POST to defeat CSRF

2026-05-26 03:59:50 +00:00

cron.go

fix(cron): switch manual trigger to POST to defeat CSRF

2026-05-26 03:59:50 +00:00

ddns.go

ddns: support provider hurricane electric (#1036)

2025-03-19 21:52:16 +08:00

fm.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

force_update_ownership_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

frontend_fallback_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

jwt_session_test.go

feat(jwt): server-side session table with keyId + obfuscated uid claims

2026-05-26 03:51:05 +00:00

jwt_test.go

test: cover multi-user permission boundaries

2026-05-17 10:24:19 +08:00

jwt.go

feat(jwt): server-side session table with keyId + obfuscated uid claims

2026-05-26 03:51:05 +00:00

nat.go

fix(controller): enforce ownership on notification group, NAT server, and batch move

2026-05-17 10:24:19 +08:00

notification_group.go

fix(controller): filter listing endpoints by ownership

2026-05-17 10:24:19 +08:00

notification.go

feat(notification): add option to convert metric units in request body (#1156)

2026-01-10 17:29:10 +08:00

oauth2.go

feat(jwt): server-side session table with keyId + obfuscated uid claims

2026-05-26 03:51:05 +00:00

permission_matrix_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

permissions.go

fix(controller): enforce ownership on notification group, NAT server, and batch move

2026-05-17 10:24:19 +08:00

server_group.go

fix(controller): filter listing endpoints by ownership

2026-05-17 10:24:19 +08:00

server.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

service.go

fix(controller): filter service transfer stats by viewer

2026-05-19 00:35:02 +00:00

setting.go

feat(v2.0.0): tsdb (#1162)

2026-02-15 13:13:33 +08:00

stream_ownership_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

terminal.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

transfer_list_filter_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

transfer_retry_authz_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

transfer.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

user.go

feat(jwt): server-side session table with keyId + obfuscated uid claims

2026-05-26 03:51:05 +00:00

waf.go

feat(waf): return ip in string literal (#947)

2025-01-04 20:49:14 +08:00

ws_stream_visibility_test.go

fix(ws): scope server stream visibility to viewer ownership

2026-05-17 03:41:28 +00:00

ws.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00