James Read
|
5e0c052e68
|
Merge branch 'next' into advisory-fix-1
|
2026-03-04 19:16:07 -05:00 |
|
James Read
|
6202736d53
|
Merge commit from fork
security: GHSA-p443-p7w5-2f7f (MODERATE) RestartAction always runs actions as guest
|
2026-03-04 19:05:48 -05:00 |
|
jamesread
|
cb46a597b2
|
security: GHSA-p443-p7w5-2f7f (MODERATE) RestartAction always runs actions as guest
|
2026-03-05 00:04:58 +00:00 |
|
James Read
|
32c7fd73b8
|
Merge commit from fork
security: GHSA-gq2m-77hf-vwgh (MODERATE) Session Fixation: Logout Fails to Invalidate Server-Side Session
|
2026-03-04 18:36:22 -05:00 |
|
jamesread
|
d6a0abc375
|
security: GHSA-gq2m-77hf-vwgh (MODERATE) Session Fixation: Logout Fails to Invalidate Server-Side Session
|
2026-03-04 23:31:15 +00:00 |
|
jamesread
|
e97d8ecbd8
|
security: GHSA-g962-2j28-3cg9 (HIGH) JWT Audience Validation Bypass in Local Key and HMAC Modes
|
2026-03-04 23:13:39 +00:00 |
|
jamesread
|
00cb5a2abf
|
fix: action triggers were broken #914
|
2026-03-04 23:12:20 +00:00 |
|
jamesread
|
0c47564652
|
chore: logs are written with 0600 instead of 0644
|
2026-03-04 23:12:20 +00:00 |
|
jamesread
|
bb14c5da3e
|
security: (MED) GHSA-fwhj-785h-43hh Crash on NPE by calling APIs with invalid bindings or log references
|
2026-03-04 22:51:58 +00:00 |
|
jamesread
|
0412b9ea1d
|
Merge branch 'next' of github.com:OliveTin/OliveTin into next
|
2026-03-02 00:35:05 +00:00 |
|
jamesread
|
d9804182ea
|
security: GHSA-4fqm-6fmh-82mq Authentication bypass in KillAction - thanks for the responsible disclosure @kule500 and making OliveTin better
|
2026-03-02 00:29:02 +00:00 |
|
jamesread
|
f044d90d55
|
security: Remote crash in OAuth2 GHSA-45m3-398w-m2m9 Thanks @kule500 for the responsible disclosure. CVE to follow.
|
2026-03-01 23:52:25 +00:00 |
|
jamesread
|
aa2bd95ccb
|
feat(policy): add policy to show/hide version number
Made-with: Cursor
|
2026-02-27 21:26:55 +00:00 |
|
jamesread
|
54eb2a6586
|
fix: User login log message fixed when password matches, but user lookup fails
|
2026-02-27 00:10:45 +00:00 |
|
jamesread
|
03da2ff2e7
|
security: Try to set cookies secure, with force override option
|
2026-02-26 23:43:50 +00:00 |
|
jamesread
|
4744169aa0
|
chore: code cleanup, remove todos, etc
|
2026-02-26 23:07:07 +00:00 |
|
jamesread
|
e9a3863b1b
|
chore: codestyle
|
2026-02-26 20:56:51 +00:00 |
|
jamesread
|
f3549b035e
|
Remove dead CORS package (L-2)
The CORS helper was unused; its import was commented out in webuiServer.go.
Deleting the package removes the dormant origin-reflection security issue.
|
2026-02-26 20:46:11 +00:00 |
|
jamesread
|
4af4d516be
|
fix: ShowDiagnostics now behind policy checks
|
2026-02-26 20:43:14 +00:00 |
|
jamesread
|
24cced0c8c
|
security: IDOR on ExecutionStatus API
|
2026-02-26 20:23:48 +00:00 |
|
James Read
|
6dfffd1170
|
security: 10-slot Semaphore around password hash functions to prevent… (#904)
|
2026-02-26 12:12:06 -05:00 |
|
jamesread
|
a7be68b359
|
security: 10-slot Semaphore around password hash functions to prevent resource exhaustion attacks
|
2026-02-26 16:49:29 +00:00 |
|
jamesread
|
cb71ddf401
|
fix: Set common security headers by default
|
2026-02-26 16:14:41 +00:00 |
|
jamesread
|
1335302e80
|
chore: codestyle
|
2026-02-26 00:48:21 +00:00 |
|
James Read
|
bee81b43f2
|
Merge branch 'next' into fix-883-logs-pagination
|
2026-02-25 18:51:46 -05:00 |
|
jamesread
|
38d6b57077
|
chore: codefmt
|
2026-02-25 23:24:02 +00:00 |
|
James Read
|
26e77a961d
|
Merge commit from fork
Advisory fix 1
|
2026-02-22 17:27:07 +00:00 |
|
jamesread
|
4bbd2eab15
|
security: GHSA-49gm-hh7w-wfvf
|
2026-02-22 10:19:08 +00:00 |
|
jamesread
|
ea4cdf9df2
|
fix: Logs page pagination (#883)
|
2026-02-19 20:33:51 +00:00 |
Andrew Savinykh
|
f58eeef49d
|
check return value from `unmarshalRoot` in test and fail if false
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
|
2026-02-15 21:28:23 +13:00 |
|
Andrew Savinykh
|
2fe6d306aa
|
substitute environment variables when loading yaml config
|
2026-02-15 20:36:03 +13:00 |
|
jamesread
|
544515c2a6
|
chore: #829, json support in template engine
|
2026-02-15 00:19:36 +00:00 |
|
James Read
|
321e8f9cb2
|
Fix: Remove JSON quotes from webhook JSONPath string extraction (#864)
|
2026-02-13 23:55:37 +00:00 |
|
jamesread
|
011ee866df
|
feat: template parsing for env in password fields
|
2026-02-13 23:53:43 +00:00 |
|
jamesread
|
1248ee8765
|
chore: remove extranious comments
|
2026-02-13 23:36:16 +00:00 |
|
James Read
|
ce5e21e2da
|
Merge branch 'next' into fix-jsonpath-quotes
|
2026-02-13 23:21:33 +00:00 |
jla
|
3afd7c26e5
|
Fix: Remove JSON quotes from webhook JSONPath string extraction
|
2026-02-07 22:35:03 -05:00 |
|
jamesread
|
086a5ffd22
|
chore: fix tpl coderabbit suggestions
|
2026-02-07 00:31:24 +00:00 |
|
jamesread
|
b777d599aa
|
fix: Massive cleanup of template parsing
|
2026-02-07 00:09:46 +00:00 |
|
James Read
|
54080efdf3
|
Fix move tpl to global (#848)
|
2026-01-26 11:33:36 +00:00 |
|
jamesread
|
561cd9c431
|
fix: Various coderabbit suggestions on tpl ext
|
2026-01-26 00:46:17 +00:00 |
|
jamesread
|
0e0bbd3fdb
|
fix: Nil binding on entity logs caused a NPE
|
2026-01-26 00:34:39 +00:00 |
|
James Read
|
cf00d179bf
|
Merge branch 'next' into fix-move-tpl-to-global
|
2026-01-25 22:53:02 +00:00 |
|
jamesread
|
e807cb5231
|
feat: configuration options for navigate-on-start icons
|
2026-01-25 21:50:03 +00:00 |
|
jamesread
|
b37f035ea6
|
fix: Move templating functionality to global, making it possible to replace templates across the config
|
2026-01-25 10:32:22 +00:00 |
|
jamesread
|
b9f55ab508
|
fix: load logs on startup (#299)
|
2026-01-23 14:18:30 +00:00 |
|
jamesread
|
aeaddda870
|
fix: add env support back
|
2026-01-23 00:04:55 +00:00 |
|
jamesread
|
f06e56857e
|
Merge branch 'main' into next
|
2026-01-22 09:27:48 +00:00 |
|
jamesread
|
e3c785319a
|
fix: Kill entire process group on timeout (#605)
|
2026-01-21 23:52:35 +00:00 |
|
jamesread
|
b3430e3a5c
|
fix: execOnCalendarFile, avoid possible crash deleting nil timers
|
2026-01-21 23:12:39 +00:00 |
|
jamesread
|
56786491e8
|
fix: Port the calender schedulding fix from 2k to 3k (#830)
|
2026-01-13 17:47:28 +00:00 |
|
jamesread
|
3d106ee13b
|
fix: JSON string marshalling in webhook uses raw strings
|
2026-01-12 00:10:40 +00:00 |
|
jamesread
|
a10088a040
|
chore: Fix duplicate code in executor when trying to reduce cyclo
|
2026-01-11 23:12:34 +00:00 |
|
James Read
|
b75d590343
|
Merge branch 'beta' into next
|
2026-01-11 23:09:49 +00:00 |
|
jamesread
|
f173a0b725
|
chore: reduce gocyclo
|
2026-01-11 22:34:23 +00:00 |
|
jamesread
|
93d56cc42e
|
chore: Fix broken unit tests, add themeLoading test
|
2026-01-11 22:24:18 +00:00 |
|
jamesread
|
87913a6ff3
|
feat: add theme selector support, load themes in a layer.
|
2026-01-11 21:32:55 +00:00 |
|
jamesread
|
242149f5a4
|
chore: reduce cyclo
|
2026-01-11 09:20:50 +00:00 |
|
jamesread
|
832db4e135
|
chore: Log datetime parse failures from cal
|
2026-01-11 08:51:31 +00:00 |
|
jamesread
|
a36e69b8f8
|
chore: calendar fixes
|
2026-01-11 01:50:27 +00:00 |
|
jamesread
|
a4ff326625
|
chore: calendar logging fixes
|
2026-01-11 01:48:17 +00:00 |
|
jamesread
|
84bd405ca9
|
chore: gocyclo fixes
|
2026-01-11 01:29:27 +00:00 |
|
jamesread
|
6493f7bee7
|
feat: block notifications, and cleanup of action/binding IDs
|
2026-01-11 01:10:20 +00:00 |
|
jamesread
|
661bcdda08
|
feat: #625 Option to save suggested values in the browser local storage across different args
|
2026-01-09 00:53:52 +00:00 |
|
jamesread
|
e96270046e
|
fix: (#765) set X-Accel-Buffering header to disable nginx buffering for event stream
|
2026-01-07 01:20:29 +00:00 |
|
James Read
|
3162b33ea9
|
feat: Enable/Disable actions based on rules (#817)
|
2026-01-07 00:47:18 +00:00 |
|
jamesread
|
c714dc0c62
|
chore: Webhooks fixes
|
2026-01-06 23:23:47 +00:00 |
|
jamesread
|
0368fb10db
|
fix: wonky merge conflict, and missing body parameter from matcher
|
2026-01-06 22:15:37 +00:00 |
|
jamesread
|
5e9c5d2c17
|
Merge branch 'feat-webhooks' of github.com:OliveTin/OliveTin into feat-webhooks
|
2026-01-06 22:12:25 +00:00 |
|
jamesread
|
0b072db36d
|
fix: Constant time comparison for webhook authentication
|
2026-01-06 22:11:41 +00:00 |
|
James Read
|
11278ff6c2
|
fix: Use constant-time comparison for Basic auth verification.
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
|
2026-01-06 22:09:17 +00:00 |
|
jamesread
|
3d5268d1c9
|
chore: enableExpression, broken test and config
|
2026-01-06 21:51:35 +00:00 |
|
jamesread
|
f22b3953b1
|
feat: webhooks support
|
2026-01-06 21:45:55 +00:00 |
|
jamesread
|
654ed15dde
|
fix: Add missing enabled expression file
|
2026-01-06 21:39:46 +00:00 |
|
jamesread
|
3e23fed3d6
|
feat: Enable/Disable actions based on rules
|
2026-01-06 21:38:18 +00:00 |
|
jamesread
|
e9d90060fd
|
chore: oauth gocyclo
|
2025-12-25 08:35:09 +00:00 |
|
James Read
|
257463997e
|
Merge branch 'next' into fix-argument-validation-on-bindings
|
2025-12-25 01:37:05 +00:00 |
|
jamesread
|
7e1a38eb9e
|
feat: add AddToUsergroup option to OAuth2 providers
|
2025-12-25 01:36:05 +00:00 |
|
jamesread
|
b4157ed5ba
|
fix: argument validation on bindings
|
2025-12-25 01:16:04 +00:00 |
|
jamesread
|
2956b9972f
|
chore: nil checks
|
2025-12-23 19:52:15 +00:00 |
|
jamesread
|
8e2db0ad82
|
chore: reduce argument validation complexity
|
2025-12-23 16:47:59 +00:00 |
|
jamesread
|
09e1f0f984
|
fix: Argument validation targets the bindings (fixes checkboxes, etc)
|
2025-12-23 16:42:00 +00:00 |
|
jamesread
|
a2410fc9d6
|
feat: Entity directories, inline actions, and all entity fields are now available in the entity details view
|
2025-12-01 21:48:27 +00:00 |
|
jamesread
|
32fea4ec30
|
feat: Dashboard configs can now self-contain their entities, and actions all in one neat file
|
2025-12-01 16:15:08 +00:00 |
|
jamesread
|
e58677e12c
|
feat: inline actions on dashboards
|
2025-12-01 12:29:41 +00:00 |
|
jamesread
|
2e82a3d1ed
|
chore: remove some dead code
|
2025-12-01 12:28:44 +00:00 |
|
jamesread
|
39009fcdd1
|
chore: code fmt
|
2025-12-01 01:59:10 +00:00 |
|
jamesread
|
56365af24b
|
feat: Mega entity improvements - entity directories, inehrit entities (#450), ordering (#762 / #703), better entity view
|
2025-12-01 01:38:04 +00:00 |
|
jamesread
|
7425db53f6
|
fix: #718 - Clear OAuth2 authentication cookie on logout
|
2025-11-30 11:19:36 +00:00 |
|
jamesread
|
470f31db6e
|
chore: Remove unecessary OAauth2 log
|
2025-11-27 00:41:53 +00:00 |
|
jamesread
|
8bad1b5400
|
fix: #703 - Entities order was non-deterministic
|
2025-11-27 00:02:08 +00:00 |
|
jamesread
|
7f1e509e12
|
chore: Little fixes for OAuth2 login
|
2025-11-26 23:28:29 +00:00 |
|
jamesread
|
f33ccbd2fa
|
fix: Log errors when loading theme CSS
|
2025-11-26 23:08:10 +00:00 |
|
jamesread
|
e9bde8b094
|
fix: OAuth2 scopes for GitHub
|
2025-11-26 23:07:55 +00:00 |
|
jamesread
|
853972384c
|
security: Possible to kill actions without authentication & credential leak in logs
|
2025-11-26 23:07:25 +00:00 |
|
jamesread
|
be7c754043
|
feat: Rebuild authentication system to support 3k authentication
|
2025-11-26 22:33:19 +00:00 |
|
jamesread
|
b244b42e91
|
fix: sort OAuth2 providers by key
|
2025-11-22 23:27:54 +00:00 |
|
jamesread
|
3d763a84df
|
fix: Various oauth issues
|
2025-11-22 22:39:05 +00:00 |
|
jamesread
|
b3e67bad75
|
doc: Add config tool to help support people
|
2025-11-16 23:08:20 +00:00 |
|
jamesread
|
d1ec688c9a
|
chore: cleanup executor.go
|
2025-11-16 00:47:03 +00:00 |
|
jamesread
|
5b57cf2480
|
fix: Logs were being displayed in the wrong order
|
2025-11-11 23:32:00 +00:00 |
|
jamesread
|
00d7285167
|
chore: fix some linting issues
|
2025-11-11 10:43:47 +00:00 |
|
jamesread
|
487bf83f4e
|
chore: use koanf tag in config reloader test
|
2025-11-10 23:39:15 +00:00 |
|
jamesread
|
67a9d3b1d1
|
chore: skip env in config test in 3k
|
2025-11-10 23:17:53 +00:00 |
|
jamesread
|
de7129e1d7
|
chore: reduce cyclomatic complexity
|
2025-11-10 23:15:18 +00:00 |
|
jamesread
|
83fe489949
|
fix: (#703) Fixed entity fieldsets being drawn in a random order
|
2025-11-10 21:08:34 +00:00 |
|
James Read
|
110bbd6216
|
Merge branch 'next' into fix-config-loading-missing-values
|
2025-11-07 00:34:11 +00:00 |
|
jamesread
|
1552c104e9
|
fix: Propperly merge included configs (handling actions)
|
2025-11-07 00:31:33 +00:00 |
|
jamesread
|
7dc99b1398
|
fix: Massively improve config loading
|
2025-11-06 23:45:54 +00:00 |
|
jamesread
|
581536a60f
|
fmt: GetActionLogs
|
2025-11-06 23:44:56 +00:00 |
|
jamesread
|
39664a734d
|
fix: Various log noise
|
2025-11-06 23:42:07 +00:00 |
|
jamesread
|
822f3197b6
|
chore: (#675) Remove dead websocket code
|
2025-11-06 09:52:16 +00:00 |
|
jamesread
|
055472902d
|
fix: #686 - concurrent map read and write - in entity instances
|
2025-11-04 23:30:14 +00:00 |
|
jamesread
|
2b24daa6d0
|
fix: Address concurrency issue in entities storage
|
2025-11-04 23:18:41 +00:00 |
|
jamesread
|
294e33d110
|
fix: #686 - concurrent map read and write
|
2025-11-04 23:03:45 +00:00 |
|
jamesread
|
83f45d71bf
|
fix: Several coderabbit suggestions on next branch
|
2025-10-30 15:51:40 +00:00 |
|
jamesread
|
79a71099f9
|
fix: fmt api.go
|
2025-10-30 15:26:29 +00:00 |
|
jamesread
|
e6a02ac614
|
chore: fix various cyclo checks
|
2025-10-30 15:25:57 +00:00 |
|
James Read
|
7abffedb14
|
Merge branch 'next' into fix-require-guests-login
|
2025-10-30 13:15:37 +00:00 |
|
jamesread
|
44b518a5b2
|
fix: panic when loading sessions.yaml
|
2025-10-30 13:04:41 +00:00 |
|
jamesread
|
a4e50bfb54
|
fix: panic when executing action with no arguments
|
2025-10-30 13:04:12 +00:00 |
|
jamesread
|
c3d5da1981
|
chore: reduce cyclo complexity in service
|
2025-10-30 12:52:58 +00:00 |
|
jamesread
|
c89979ddb2
|
fix: Wait for login UI to appear in authRequireGuestsToLogin test
|
2025-10-30 11:05:14 +00:00 |
|
James Read
|
430aab638b
|
Merge branch 'next' into fix-require-guests-login
|
2025-10-30 09:20:24 +00:00 |
|
jamesread
|
d21f06e555
|
fix: Require guests to login
|
2025-10-30 02:13:40 +00:00 |
|
jamesread
|
19c3b67cdd
|
fix: fix panic in pagination if we get a bad request
|
2025-10-30 00:12:06 +00:00 |
|
jamesread
|
61fc771ac3
|
fix: Race condition and speedup in accessing streaming clients
|
2025-10-30 00:03:37 +00:00 |
|
jamesread
|
57390be16f
|
feat: ActionDetailsView component, show timeout and logs for action. Fix output streaming.
|
2025-10-29 22:45:26 +00:00 |
|
jamesread
|
6c6d07bf4f
|
fix: #674 Use JSON options for API handler
|
2025-10-27 20:40:15 +00:00 |
|
jamesread
|
2ea35697d0
|
fix: #672 Empty execution tracking ID in InternalLogEntry
|
2025-10-27 15:42:13 +00:00 |
|
jamesread
|
a551589840
|
feat: #428 Initial support for include directive in config files
|
2025-10-27 15:32:30 +00:00 |
|
jamesread
|
fcd3ccc59a
|
fix: authRequireGuestsToLogin config, and config loading improvements
|
2025-10-27 14:56:32 +00:00 |
|
jamesread
|
9fbaa8671f
|
fix: Banner message support
|
2025-10-27 14:20:26 +00:00 |
|
jamesread
|
c86bf629f9
|
bugfix: Added nil checks
|
2025-10-26 17:32:26 +00:00 |
|
jamesread
|
c917d1b1e7
|
bugfix: #639 Exec support, disallow URL and similar arguments with
|
2025-10-26 16:40:44 +00:00 |
|
jamesread
|
8686a5629e
|
fix: User Information panel and login/logout flow
|
2025-10-26 13:42:06 +00:00 |
|
jamesread
|
43cfe41378
|
fix: Issues with login form and local auth
|
2025-10-26 13:24:22 +00:00 |
|
jamesread
|
a7e7bf869e
|
fix: WIP on login regression
|
2025-10-25 00:31:02 +01:00 |
|
jamesread
|
0dd9e9b2b7
|
fix: guard against nil session storage
|
2025-10-25 00:22:28 +01:00 |
|
jamesread
|
aa8322c354
|
fix: guard against nil session storage
|
2025-10-25 00:20:56 +01:00 |
|
jamesread
|
956e74a6b3
|
fix: Don't log SID (!) SECURITY
|
2025-10-25 00:20:35 +01:00 |
|
jamesread
|
3b8bc49b04
|
feat: Fixed session management and ripped out the rest of gRPC
|
2025-10-24 23:48:48 +01:00 |
|
jamesread
|
38d81fafe2
|
fix: Listen address fields were not being loaded from config.yaml
|
2025-10-24 22:06:32 +01:00 |
|
jamesread
|
cbb163726e
|
chore: wip OliveTin3k
|
2025-10-23 23:16:39 +01:00 |
|
jamesread
|
c9c781b197
|
fix: webui directory search
|
2025-10-11 01:16:06 +01:00 |
|
jamesread
|
60814b97e2
|
chore: fix gocyclo issues
|
2025-10-11 00:52:18 +01:00 |
|
jamesread
|
b330fbd1a5
|
fix: all broken integration tests
|
2025-10-11 00:45:41 +01:00 |
|
jamesread
|
a464e6a445
|
fix: broken tests after changing the way arguments are parsed
|
2025-10-01 22:20:56 +01:00 |
Tim Green
|
a26a8bb032
|
chore: update the docs link for timeouts in the error message (#651)
|
2025-10-01 07:18:39 +01:00 |
|
jamesread
|
570c0ba087
|
chore: Repair output streaming, lots of css/go lint
|
2025-09-06 08:42:13 +01:00 |