Commit Graph
2128 Commits
Author SHA1 Message Date
naturallaw777 9051aed737 fix: sanitize exception handling in verify-integrity and security-reset (CWE-209) 2026-08-07 14:58:24 -05:00
Sovran SystemsandGitHub 65376ec8fb Merge pull request #395 from naturallaw777/fix/exception-exposure-5252
fix: sanitize api_security_reset errors to prevent exception informat…
2026-08-07 14:40:08 -05:00
naturallaw777 899f570ded fix: sanitize api_security_reset errors to prevent exception information exposure (CWE-209) 2026-08-07 14:31:38 -05:00
Sovran SystemsandGitHub d3b41b14fb Merge pull request #394 from naturallaw777/fix/path-injection-4338
fix: pass sanitized abs_path to os.chown to resolve CodeQL path injec…
2026-08-07 14:23:57 -05:00
naturallaw777 56db634900 fix: use canonical prefix containment check for CodeQL path-injection 2026-08-07 14:22:44 -05:00
naturallaw777 3522270373 fix: pass sanitized abs_path to os.chown to resolve CodeQL path injection at 4338 2026-08-07 14:17:34 -05:00
Sovran SystemsandGitHub efda70c187 Merge pull request #393 from naturallaw777/fix/path-injection-4334-4532
fix: add CodeQL-recognized path sanitization for domain_name
2026-08-07 13:51:28 -05:00
a32b353eda fix: resolve merge conflict with origin/main in server.py
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
2026-08-07 18:50:01 +00:00
naturallaw777 4555764d87 fix: add CodeQL-recognized path sanitization for domain_name 2026-08-07 13:44:26 -05:00
Sovran SystemsandGitHub c38d4be851 Merge pull request #392 from naturallaw777/fix/path-injection-4334-4532
fix: add CodeQL-recognized path sanitization for domain_name
2026-08-07 13:36:03 -05:00
naturallaw777 5130076400 fix: add CodeQL-recognized path sanitization for domain_name 2026-08-07 13:33:55 -05:00
Sovran SystemsandGitHub 1dbbd6a943 Merge pull request #391 from naturallaw777/fix/njalla-sentinel-4371
fix: remove domain substring check for CodeQL incomplete-url
2026-08-07 13:28:14 -05:00
naturallaw777 f0a640519d fix: remove domain substring check for CodeQL incomplete-url 2026-08-07 13:26:41 -05:00
naturallaw777 a14ef03d40 fix: use sentinel for njalla header check (CodeQL incomplete-url-substring) 2026-08-07 13:07:06 -05:00
Sovran SystemsandGitHub a0cc7e6bec Merge pull request #390 from naturallaw777/fix/xss-lnurl-qr-print-5013
fix: prevent reflected XSS in lnurl-qr print endpoint
2026-08-07 13:00:46 -05:00
naturallaw777 1ecf245a07 fix: prevent reflected XSS in lnurl-qr print endpoint 2026-08-07 12:59:08 -05:00
Sovran SystemsandGitHub f8730cc0ab Merge pull request #389 from naturallaw777/fix/clear-text-root-password
fix: hash root password instead of storing in clear text (CWE-312)
2026-08-07 12:39:48 -05:00
Contributorandnaturallaw777 8a766181de fix: hash root password instead of storing in clear text (CWE-312)
- Replace plain-text write of new_root_password in api_security_reset()
  with scrypt-hashed storage via _hash_password(), matching how the free
  password is already handled.

- Return new_root_password in the API response so the user sees it once
  before it is irreversibly hashed on disk.

- Teach _resolve_credential() to detect scrypt hashes and display a
  human-readable placeholder instead of raw hex in the Hub credentials UI.

- Harden root-password-setup systemd service: if the secrets file already
  contains a hash, skip chpasswd so a manual restart never sets the hash
  as the literal login password.
2026-08-07 12:34:13 -05:00
naturallaw777 bd0d2cd812 removed temp patch file 2026-08-07 12:16:11 -05:00
naturallaw777 592f2bd12f fix: separate web auth hash from system password file
- Add FREE_PASSWORD_FILE_WEB for scrypt hashes
- Legacy fallback + auto-migrate in _check_password
- chpasswd sync in api_change_password and security reset endpoint
2026-08-07 12:04:07 -05:00
Sovran SystemsandGitHub b7bba228fe Merge pull request #387 from naturallaw777/fix/matrix-hub-service-admin
Fix Matrix Hub service-admin provisioning
2026-08-07 11:10:48 -05:00
Sovran Systems 3010557064 Fix Matrix Hub admin API credentials 2026-08-07 16:09:13 +00:00
Sovran SystemsandGitHub 69f64c18d1 Merge pull request #386 from naturallaw777/copilot/fix-code-scanning-alerts
Fix CWE-78 command injection in Matrix create-user endpoint
2026-08-07 10:13:04 -05:00
942da64332 Fix CWE-78: replace subprocess call with Synapse Admin API in create-user endpoint
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
2026-08-07 15:09:36 +00:00
copilot-swe-agent[bot]andGitHub bae790ebb4 Initial plan 2026-08-07 15:07:32 +00:00
naturallaw777 501c5abe64 docs: add SECURITY.md detailing security policy and best practices 2026-08-06 14:09:35 -05:00
Sovran SystemsandGitHub 63f1069e4a Merge pull request #385 from naturallaw777/arena/019fd2b5-sovran-systemsos
docs: versioned CDN downloads + add CDN upload script
2026-08-05 11:18:26 -05:00
naturallaw777andarena-agent f2842ffafb docs: versioned CDN downloads + add CDN upload script
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
2026-08-05 16:16:59 +00:00
Sovran SystemsandGitHub 591ae766d2 Merge pull request #384 from naturallaw777/arena/019fd28e-sovran-systemsos
iso: fix replaceStrings length mismatch breaking ISO build
2026-08-05 10:39:02 -05:00
naturallaw777andarena-agent f81b27cc19 iso: fix replaceStrings length mismatch in cleanVersion
builtins.replaceStrings requires the 'from' and 'to' lists to have the
same length. The 'to' list had a single empty string while 'from' had
three entries (v, newline, CR), which made evaluating image.baseName
fail with: 'from' and 'to' arguments passed to builtins.replaceStrings
have different lengths. Add the two missing empty strings.

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
2026-08-05 15:38:21 +00:00
Sovran SystemsandGitHub dda6fb8e91 Merge pull request #383 from naturallaw777/arena/019fcf25-sovran-systemsos
Promote virtual machine trial option in README
2026-08-04 19:43:06 -05:00
naturallaw777andarena-agent cf250604f9 Promote virtual machine trial option in README
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
2026-08-05 00:42:42 +00:00
Sovran SystemsandGitHub 963d41f1ed Merge pull request #382 from naturallaw777/arena/019fce1d-sovran-systemsos
Improve installer VM compatibility
2026-08-04 14:08:45 -05:00
naturallaw777andarena-agent 5188cca9aa Improve installer VM compatibility
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
2026-08-04 19:07:51 +00:00
Sovran SystemsandGitHub f39f59fb81 Merge pull request #381 from naturallaw777/arena/019fcde4-sovran-systemsos
Trim redundant dev-vs-stable Gitea explanations in README
2026-08-04 13:24:52 -05:00
naturallaw777andarena-agent 61fc61cceb Trim redundant dev-vs-stable Gitea explanations in README
Replace repeated prose across 4 sections with a compact table + flow arrow:
- Top callout: 7-line paragraph → 2-line summary + link
- Development workflow: 2 bullets + 3-step list + warning → 3-row table + flow arrow
- Build from source: re-explained sync relationship → single labels on clone commands
- Contributing footer: repeated branch/host info → one sentence

No information lost; ~270 words removed.

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
2026-08-04 18:23:54 +00:00
Sovran SystemsandGitHub 4b9800aef3 Merge pull request #380 from naturallaw777/arena/019fcdbe-sovran-systemsos
docs: correct active development workflow
2026-08-04 12:17:34 -05:00
naturallaw777andarena-agent c447674ef9 docs: correct active development workflow
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
2026-08-04 17:16:46 +00:00
Sovran SystemsandGitHub a77bfc5070 Merge pull request #379 from naturallaw777/arena/019fcda3-sovran-systemsos
docs: clarify GitHub dev-mirror workflow and Gitea stable home
2026-08-04 12:04:46 -05:00
naturallaw777andarena-agent 7b381d0387 docs: make repo references mirror-neutral for Gitea readers
The README and CONTRIBUTING are mirrored to both Gitea branches, so
GitHub-specific references now name the GitHub repository explicitly
instead of saying 'this repository'.

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
2026-08-04 17:03:52 +00:00
naturallaw777andarena-agent ec43d631d4 docs: clarify GitHub is the dev mirror of the Gitea stable repo
The GitHub repo mirrors Gitea's staging-dev branch; changes are tested
here and promoted to the stable branch on the self-hosted Gitea instance.

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
2026-08-04 16:39:27 +00:00
Sovran SystemsandGitHub 82a9952e63 Add Arean.Ai to AI tools used for development
Updated the mention of AI tools used in development.
2026-08-04 11:33:50 -05:00
arena-ai-coding-agent[bot]andGitHub 1eb4be2c01 Merge pull request #378 from naturallaw777/arena/019fcd8d-sovran-systemsos
Move OS version badge inline right after the Hub title
2026-08-04 16:31:20 +00:00
naturallaw777andarena-agent 6f1edb938e Prefix OS version badge with 'v' (v1.0.5)
Keeps the modal-matching neutral pill styling; the badge now reads
"v1.0.5" as plain uniform text instead of the bare number.

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
2026-08-04 16:29:52 +00:00
naturallaw777andarena-agent bd96782229 Match OS version badge styling to service modal version badges
The header badge now uses the exact visual treatment of
.creds-title-version-badge from modals.css: neutral translucent pill
(rgba(255,255,255,0.06) background, 0.08 white border, 12px radius,
--text-secondary text, 0.72rem/600/2px-10px padding), no hover
animation, and a bare version number like the modals show (e.g.
"2.8.4") instead of the green pill with a "v" prefix.

The badge markup flattens to a single text span; the .version-label
and .version-number rules are removed.

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
2026-08-04 16:27:36 +00:00
naturallaw777andarena-agent cf23438a5c Place OS version badge inline right after the Hub title
Mirrors the service modal pattern where the version badge sits to the
right of the title: .title-group switches from a centered column
(badge under the title, PR #377) to a centered row with the badge
vertically centered directly after "Sovran_SystemsOS Hub".

flex-wrap keeps a graceful fallback: on very narrow screens the badge
wraps below the title, centered — the previous stacked look.

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
2026-08-04 16:21:39 +00:00
Sovran SystemsandGitHub d2c3fd066e Merge pull request #377 from naturallaw777/arena/019fcd82-sovran-systemsos
Center OS version badge under the Hub title
2026-08-04 11:05:33 -05:00
naturallaw777andarena-agent 1bfec68d77 Center OS version badge under the Hub title
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
2026-08-04 16:04:56 +00:00
Sovran SystemsandGitHub bda1372a1d Merge pull request #376 from naturallaw777/arena/019fcd69-sovran-systemsos
Add 'About Bitcoin wallet entropy' section to README
2026-08-04 10:59:09 -05:00
naturallaw777andarena-agent 13c700ca44 Strengthen entropy section: add DYOR emphasis and hardware wallet verification note
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
2026-08-04 15:51:39 +00:00