naibaandcloudcode d4837dfc7a fix(security): reserve dashboard hosts from NAT and re-check DDNS profile ownership at worker time ...

GHSA-x6fg-52vr-hj4w: NAT is a commonHandler any authenticated member can
create, and newHTTPandGRPCMux matches r.Host against NAT before dispatching
the dashboard/gRPC handlers, so a member could register the dashboard's own
host as a NAT Domain and hijack global routing. Add IsReservedDashboardHost
(InstallHost/ListenHost plus an operator-declared ReservedHosts list for
reverse-proxy deployments), reject reserved hosts on create/update, and drop
pre-planted records when building the startup cache.

GHSA-39g2-8x68-pmx8: bind-time CheckPermission let a member pre-bind a DDNS
profile ID that the victim would only create later. GetDDNSProvidersFromProfiles
now re-validates ownership by server owner UID and skips foreign-owned
profiles (UserID==0 is treated as a migration artifact, not an admin grant).

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

2026-05-31 02:04:35 +00:00

..

admin-dist

feat: embed dist

2024-11-29 21:31:39 +08:00

controller

fix(security): reserve dashboard hosts from NAT and re-check DDNS profile ownership at worker time

2026-05-31 02:04:35 +00:00

rpc

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

user-dist

feat: embed dist

2024-11-29 21:31:39 +08:00

main.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00