medlogic
/
olivetin
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
1,336 Commits 1 Branch 0 Tags 12 MiB
Commit Graph

231 Commits

Author SHA1 Message Date
jamesread b298a6bd8c chore: Treat root fieldset separately for ordering 2026-03-09 09:31:40 +00:00
jamesread dcb5bd0c82 chore: Allow entity key ordering for actionless components 2026-03-09 09:18:24 +00:00
jamesread 93a9636a82 chore: additional test coverage for view permission 2026-03-09 08:55:47 +00:00
jamesread 2f77000de4 security: GHSA-364q-w7vh-vhpc (HIGH) Unsafe parsing of UniqueTrackingId can be used to write files 2026-03-08 23:29:00 +00:00
jamesread 71bb999950 security: Actions that people didnt have permission to view were being returned (#921) 2026-03-08 22:45:46 +00:00
jamesread 5ff6b5d080 fix: Entity ordering (#886, #762) 2026-03-08 22:16:24 +00:00
jamesread 3f46007281 fix: Relax default CSP to allow iconify to work 2026-03-08 20:46:52 +00:00
jamesread b032ae5e5e chore: fix regression on arguments not being found 2026-03-05 08:29:30 +00:00
James Read 93d983c506
Merge branch 'next' into advisory-fix-1 2026-03-05 03:24:12 -05:00
jamesread d7962710e7 security: GHSA-jf73-858c-54pg (MODERATE) View permission not being checked when returning dashboards 2026-03-05 08:20:02 +00:00
jamesread 9080577f2b chore: potential crash in unit tests 2026-03-05 08:10:56 +00:00
James Read 5e0c052e68
Merge branch 'next' into advisory-fix-1 2026-03-04 19:16:07 -05:00
James Read 6202736d53
Merge commit from fork 
security: GHSA-p443-p7w5-2f7f (MODERATE) RestartAction always runs actions as guest
 2026-03-04 19:05:48 -05:00
jamesread cb46a597b2 security: GHSA-p443-p7w5-2f7f (MODERATE) RestartAction always runs actions as guest 2026-03-05 00:04:58 +00:00
James Read 32c7fd73b8
Merge commit from fork 
security: GHSA-gq2m-77hf-vwgh (MODERATE) Session Fixation: Logout Fails to Invalidate Server-Side Session
 2026-03-04 18:36:22 -05:00
jamesread d6a0abc375 security: GHSA-gq2m-77hf-vwgh (MODERATE) Session Fixation: Logout Fails to Invalidate Server-Side Session 2026-03-04 23:31:15 +00:00
jamesread e97d8ecbd8 security: GHSA-g962-2j28-3cg9 (HIGH) JWT Audience Validation Bypass in Local Key and HMAC Modes 2026-03-04 23:13:39 +00:00
jamesread 00cb5a2abf fix: action triggers were broken #914 2026-03-04 23:12:20 +00:00
jamesread 0c47564652 chore: logs are written with 0600 instead of 0644 2026-03-04 23:12:20 +00:00
jamesread bb14c5da3e security: (MED) GHSA-fwhj-785h-43hh Crash on NPE by calling APIs with invalid bindings or log references 2026-03-04 22:51:58 +00:00
jamesread 0412b9ea1d Merge branch 'next' of github.com:OliveTin/OliveTin into next 2026-03-02 00:35:05 +00:00
jamesread d9804182ea security: GHSA-4fqm-6fmh-82mq Authentication bypass in KillAction - thanks for the responsible disclosure @kule500 and making OliveTin better 2026-03-02 00:29:02 +00:00
James Read 58b0a7b8f6
Security remote crash in oauth2 (#910) 2026-03-01 19:14:36 -05:00
jamesread f044d90d55 security: Remote crash in OAuth2 GHSA-45m3-398w-m2m9 Thanks @kule500 for the responsible disclosure. CVE to follow. 2026-03-01 23:52:25 +00:00
James Read e67fac17d0
Merge branch 'next' into dependabot/go_modules/service/next/github.com/bufbuild/buf-1.66.0 2026-03-01 17:16:45 -05:00
jamesread aa2bd95ccb feat(policy): add policy to show/hide version number 
Made-with: Cursor
 2026-02-27 21:26:55 +00:00
jamesread 54eb2a6586 fix: User login log message fixed when password matches, but user lookup fails 2026-02-27 00:10:45 +00:00
jamesread 03da2ff2e7 security: Try to set cookies secure, with force override option 2026-02-26 23:43:50 +00:00
jamesread 4744169aa0 chore: code cleanup, remove todos, etc 2026-02-26 23:07:07 +00:00
jamesread e9a3863b1b chore: codestyle 2026-02-26 20:56:51 +00:00
jamesread f3549b035e Remove dead CORS package (L-2) 
The CORS helper was unused; its import was commented out in webuiServer.go.
Deleting the package removes the dormant origin-reflection security issue.
 2026-02-26 20:46:11 +00:00
jamesread 4af4d516be fix: ShowDiagnostics now behind policy checks 2026-02-26 20:43:14 +00:00
jamesread 24cced0c8c security: IDOR on ExecutionStatus API 2026-02-26 20:23:48 +00:00
James Read 6dfffd1170
security: 10-slot Semaphore around password hash functions to prevent… (#904) 2026-02-26 12:12:06 -05:00
jamesread a7be68b359 security: 10-slot Semaphore around password hash functions to prevent resource exhaustion attacks 2026-02-26 16:49:29 +00:00
jamesread cb71ddf401 fix: Set common security headers by default 2026-02-26 16:14:41 +00:00
dependabot[bot] ff3620bca9
chore(deps): bump github.com/bufbuild/buf in /service 
Bumps [github.com/bufbuild/buf](https://github.com/bufbuild/buf) from 1.65.0 to 1.66.0.
- [Release notes](https://github.com/bufbuild/buf/releases)
- [Changelog](https://github.com/bufbuild/buf/blob/main/CHANGELOG.md)
- [Commits](https://github.com/bufbuild/buf/compare/v1.65.0...v1.66.0)

---
updated-dependencies:
- dependency-name: github.com/bufbuild/buf
  dependency-version: 1.66.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-26 07:24:25 +00:00
jamesread 1335302e80 chore: codestyle 2026-02-26 00:48:21 +00:00
James Read bee81b43f2
Merge branch 'next' into fix-883-logs-pagination 2026-02-25 18:51:46 -05:00
jamesread 38d6b57077 chore: codefmt 2026-02-25 23:24:02 +00:00
James Read 26e77a961d
Merge commit from fork 
Advisory fix 1
 2026-02-22 17:27:07 +00:00
jamesread 4bbd2eab15 security: GHSA-49gm-hh7w-wfvf 2026-02-22 10:19:08 +00:00
jamesread ea4cdf9df2 fix: Logs page pagination (#883) 2026-02-19 20:33:51 +00:00
jamesread 544515c2a6 chore: #829, json support in template engine 2026-02-15 00:19:36 +00:00
James Read 321e8f9cb2
Fix: Remove JSON quotes from webhook JSONPath string extraction (#864) 2026-02-13 23:55:37 +00:00
jamesread 011ee866df feat: template parsing for env in password fields 2026-02-13 23:53:43 +00:00
jamesread 1248ee8765 chore: remove extranious comments 2026-02-13 23:36:16 +00:00
James Read ce5e21e2da
Merge branch 'next' into fix-jsonpath-quotes 2026-02-13 23:21:33 +00:00
jamesread cc8d8652f1 chore: dep update Feb 2026 2026-02-13 18:38:17 +00:00
jla 3afd7c26e5 Fix: Remove JSON quotes from webhook JSONPath string extraction 2026-02-07 22:35:03 -05:00