mirror of
https://github.com/Part-DB/Part-DB-server.git
synced 2026-05-19 18:01:30 +00:00
dd8698840d
Address security review feedback from jbtronics: - Add IS_AUTHENTICATED_FULLY to all sensitive endpoints (create/delete backup, delete log, download backup, start update, restore) - Change backup download from GET to POST with CSRF token - Require password confirmation before downloading backups (backups contain sensitive data like password hashes and secrets) - Add DISABLE_BACKUP_DOWNLOAD env var (default: disabled) to control whether backup downloads are allowed - Add password confirmation modal with security warning in template - Add comprehensive tests: auth checks, env var blocking, POST-only enforcement, status/progress endpoint auth |
||
|---|---|---|
| .. | ||
| API | ||
| assets | ||
| Command | ||
| Controller | ||
| DataTables/Filters | ||
| Doctrine | ||
| Entity | ||
| EnvVarProcessors | ||
| EventListener | ||
| EventSubscriber | ||
| Exceptions | ||
| Form/InfoProviderSystem | ||
| Helpers | ||
| Repository | ||
| Security | ||
| Serializer | ||
| Services | ||
| Settings | ||
| Twig | ||
| Validator | ||
| .gitignore | ||
| ApplicationAvailabilityFunctionalTest.php | ||
| bootstrap.php | ||
| DatatablesAvailabilityTest.php | ||
| object-manager.php | ||
| SettingsTestHelper.php | ||
| symfony-container.php | ||