medlogic
/
olivetin
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
1,614 Commits 1 Branch 0 Tags 12 MiB
Commit Graph

335 Commits

Author SHA1 Message Date
jamesread bc5e9fbe1e security: GHSA-xx6g-43w2-9g6g (MODERATE) Email argument makes compliance harder, enables log injection 2026-03-10 23:27:09 +00:00
jamesread b33aded230 chore: Use a constant for the default CSP 2026-03-09 10:00:47 +00:00
jamesread b298a6bd8c chore: Treat root fieldset separately for ordering 2026-03-09 09:31:40 +00:00
jamesread dcb5bd0c82 chore: Allow entity key ordering for actionless components 2026-03-09 09:18:24 +00:00
jamesread 93a9636a82 chore: additional test coverage for view permission 2026-03-09 08:55:47 +00:00
jamesread 2f77000de4 security: GHSA-364q-w7vh-vhpc (HIGH) Unsafe parsing of UniqueTrackingId can be used to write files 2026-03-08 23:29:00 +00:00
jamesread 71bb999950 security: Actions that people didnt have permission to view were being returned (#921) 2026-03-08 22:45:46 +00:00
jamesread 5ff6b5d080 fix: Entity ordering (#886, #762) 2026-03-08 22:16:24 +00:00
jamesread 3f46007281 fix: Relax default CSP to allow iconify to work 2026-03-08 20:46:52 +00:00
jamesread b032ae5e5e chore: fix regression on arguments not being found 2026-03-05 08:29:30 +00:00
James Read 93d983c506
Merge branch 'next' into advisory-fix-1 2026-03-05 03:24:12 -05:00
jamesread d7962710e7 security: GHSA-jf73-858c-54pg (MODERATE) View permission not being checked when returning dashboards 2026-03-05 08:20:02 +00:00
jamesread 9080577f2b chore: potential crash in unit tests 2026-03-05 08:10:56 +00:00
James Read 5e0c052e68
Merge branch 'next' into advisory-fix-1 2026-03-04 19:16:07 -05:00
James Read 6202736d53
Merge commit from fork 
security: GHSA-p443-p7w5-2f7f (MODERATE) RestartAction always runs actions as guest
 2026-03-04 19:05:48 -05:00
jamesread cb46a597b2 security: GHSA-p443-p7w5-2f7f (MODERATE) RestartAction always runs actions as guest 2026-03-05 00:04:58 +00:00
James Read 32c7fd73b8
Merge commit from fork 
security: GHSA-gq2m-77hf-vwgh (MODERATE) Session Fixation: Logout Fails to Invalidate Server-Side Session
 2026-03-04 18:36:22 -05:00
jamesread d6a0abc375 security: GHSA-gq2m-77hf-vwgh (MODERATE) Session Fixation: Logout Fails to Invalidate Server-Side Session 2026-03-04 23:31:15 +00:00
jamesread e97d8ecbd8 security: GHSA-g962-2j28-3cg9 (HIGH) JWT Audience Validation Bypass in Local Key and HMAC Modes 2026-03-04 23:13:39 +00:00
jamesread 00cb5a2abf fix: action triggers were broken #914 2026-03-04 23:12:20 +00:00
jamesread 0c47564652 chore: logs are written with 0600 instead of 0644 2026-03-04 23:12:20 +00:00
jamesread bb14c5da3e security: (MED) GHSA-fwhj-785h-43hh Crash on NPE by calling APIs with invalid bindings or log references 2026-03-04 22:51:58 +00:00
jamesread 0412b9ea1d Merge branch 'next' of github.com:OliveTin/OliveTin into next 2026-03-02 00:35:05 +00:00
jamesread d9804182ea security: GHSA-4fqm-6fmh-82mq Authentication bypass in KillAction - thanks for the responsible disclosure @kule500 and making OliveTin better 2026-03-02 00:29:02 +00:00
James Read 58b0a7b8f6
Security remote crash in oauth2 (#910) 2026-03-01 19:14:36 -05:00
jamesread f044d90d55 security: Remote crash in OAuth2 GHSA-45m3-398w-m2m9 Thanks @kule500 for the responsible disclosure. CVE to follow. 2026-03-01 23:52:25 +00:00
James Read e67fac17d0
Merge branch 'next' into dependabot/go_modules/service/next/github.com/bufbuild/buf-1.66.0 2026-03-01 17:16:45 -05:00
jamesread aa2bd95ccb feat(policy): add policy to show/hide version number 
Made-with: Cursor
 2026-02-27 21:26:55 +00:00
jamesread 54eb2a6586 fix: User login log message fixed when password matches, but user lookup fails 2026-02-27 00:10:45 +00:00
jamesread 03da2ff2e7 security: Try to set cookies secure, with force override option 2026-02-26 23:43:50 +00:00
jamesread 4744169aa0 chore: code cleanup, remove todos, etc 2026-02-26 23:07:07 +00:00
jamesread e9a3863b1b chore: codestyle 2026-02-26 20:56:51 +00:00
jamesread f3549b035e Remove dead CORS package (L-2) 
The CORS helper was unused; its import was commented out in webuiServer.go.
Deleting the package removes the dormant origin-reflection security issue.
 2026-02-26 20:46:11 +00:00
jamesread 4af4d516be fix: ShowDiagnostics now behind policy checks 2026-02-26 20:43:14 +00:00
jamesread 24cced0c8c security: IDOR on ExecutionStatus API 2026-02-26 20:23:48 +00:00
James Read 6dfffd1170
security: 10-slot Semaphore around password hash functions to prevent… (#904) 2026-02-26 12:12:06 -05:00
jamesread a7be68b359 security: 10-slot Semaphore around password hash functions to prevent resource exhaustion attacks 2026-02-26 16:49:29 +00:00
jamesread cb71ddf401 fix: Set common security headers by default 2026-02-26 16:14:41 +00:00
dependabot[bot] ff3620bca9
chore(deps): bump github.com/bufbuild/buf in /service 
Bumps [github.com/bufbuild/buf](https://github.com/bufbuild/buf) from 1.65.0 to 1.66.0.
- [Release notes](https://github.com/bufbuild/buf/releases)
- [Changelog](https://github.com/bufbuild/buf/blob/main/CHANGELOG.md)
- [Commits](https://github.com/bufbuild/buf/compare/v1.65.0...v1.66.0)

---
updated-dependencies:
- dependency-name: github.com/bufbuild/buf
  dependency-version: 1.66.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-26 07:24:25 +00:00
jamesread 1335302e80 chore: codestyle 2026-02-26 00:48:21 +00:00
James Read bee81b43f2
Merge branch 'next' into fix-883-logs-pagination 2026-02-25 18:51:46 -05:00
jamesread 38d6b57077 chore: codefmt 2026-02-25 23:24:02 +00:00
James Read 26e77a961d
Merge commit from fork 
Advisory fix 1
 2026-02-22 17:27:07 +00:00
jamesread 4bbd2eab15 security: GHSA-49gm-hh7w-wfvf 2026-02-22 10:19:08 +00:00
jamesread ea4cdf9df2 fix: Logs page pagination (#883) 2026-02-19 20:33:51 +00:00
Andrew Savinykh f58eeef49d
check return value from `unmarshalRoot` in test and fail if false 
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
 2026-02-15 21:28:23 +13:00
Andrew Savinykh 2fe6d306aa substitute environment variables when loading yaml config 2026-02-15 20:36:03 +13:00
jamesread 544515c2a6 chore: #829, json support in template engine 2026-02-15 00:19:36 +00:00
James Read 321e8f9cb2
Fix: Remove JSON quotes from webhook JSONPath string extraction (#864) 2026-02-13 23:55:37 +00:00
jamesread 011ee866df feat: template parsing for env in password fields 2026-02-13 23:53:43 +00:00
jamesread 1248ee8765 chore: remove extranious comments 2026-02-13 23:36:16 +00:00
James Read ce5e21e2da
Merge branch 'next' into fix-jsonpath-quotes 2026-02-13 23:21:33 +00:00
jamesread cc8d8652f1 chore: dep update Feb 2026 2026-02-13 18:38:17 +00:00
jla 3afd7c26e5 Fix: Remove JSON quotes from webhook JSONPath string extraction 2026-02-07 22:35:03 -05:00
jamesread 086a5ffd22 chore: fix tpl coderabbit suggestions 2026-02-07 00:31:24 +00:00
jamesread b777d599aa fix: Massive cleanup of template parsing 2026-02-07 00:09:46 +00:00
dependabot[bot] 19641695f1
chore(deps): bump github.com/golang-jwt/jwt/v5 in /service 
Bumps [github.com/golang-jwt/jwt/v5](https://github.com/golang-jwt/jwt) from 5.3.0 to 5.3.1.
- [Release notes](https://github.com/golang-jwt/jwt/releases)
- [Commits](https://github.com/golang-jwt/jwt/compare/v5.3.0...v5.3.1)

---
updated-dependencies:
- dependency-name: github.com/golang-jwt/jwt/v5
  dependency-version: 5.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-02 05:56:16 +00:00
jamesread efbab6776f chore: Dep update Jan 2026 2026-01-26 11:36:48 +00:00
James Read 54080efdf3
Fix move tpl to global (#848) 2026-01-26 11:33:36 +00:00
jamesread 561cd9c431 fix: Various coderabbit suggestions on tpl ext 2026-01-26 00:46:17 +00:00
jamesread 0e0bbd3fdb fix: Nil binding on entity logs caused a NPE 2026-01-26 00:34:39 +00:00
James Read cf00d179bf
Merge branch 'next' into fix-move-tpl-to-global 2026-01-25 22:53:02 +00:00
jamesread e807cb5231 feat: configuration options for navigate-on-start icons 2026-01-25 21:50:03 +00:00
jamesread b37f035ea6 fix: Move templating functionality to global, making it possible to replace templates across the config 2026-01-25 10:32:22 +00:00
jamesread b9f55ab508 fix: load logs on startup (#299) 2026-01-23 14:18:30 +00:00
jamesread aeaddda870 fix: add env support back 2026-01-23 00:04:55 +00:00
jamesread f06e56857e Merge branch 'main' into next 2026-01-22 09:27:48 +00:00
James Read 97c59b764c
fix: Port the calender schedulding fix from 2k to 3k (#830) (#831) 2026-01-22 09:13:19 +00:00
jamesread e3c785319a fix: Kill entire process group on timeout (#605) 2026-01-21 23:52:35 +00:00
jamesread b3430e3a5c fix: execOnCalendarFile, avoid possible crash deleting nil timers 2026-01-21 23:12:39 +00:00
jamesread b024c4a91b chore: Dependency bump Jan 2026 2026-01-21 13:23:36 +00:00
jamesread 56786491e8 fix: Port the calender schedulding fix from 2k to 3k (#830) 2026-01-13 17:47:28 +00:00
jamesread 3d106ee13b fix: JSON string marshalling in webhook uses raw strings 2026-01-12 00:10:40 +00:00
jamesread a10088a040 chore: Fix duplicate code in executor when trying to reduce cyclo 2026-01-11 23:12:34 +00:00
James Read b75d590343
Merge branch 'beta' into next 2026-01-11 23:09:49 +00:00
jamesread f173a0b725 chore: reduce gocyclo 2026-01-11 22:34:23 +00:00
jamesread 93d56cc42e chore: Fix broken unit tests, add themeLoading test 2026-01-11 22:24:18 +00:00
jamesread 87913a6ff3 feat: add theme selector support, load themes in a layer. 2026-01-11 21:32:55 +00:00
jamesread 242149f5a4 chore: reduce cyclo 2026-01-11 09:20:50 +00:00
jamesread 832db4e135 chore: Log datetime parse failures from cal 2026-01-11 08:51:31 +00:00
jamesread a36e69b8f8 chore: calendar fixes 2026-01-11 01:50:27 +00:00
jamesread a4ff326625 chore: calendar logging fixes 2026-01-11 01:48:17 +00:00
jamesread 84bd405ca9 chore: gocyclo fixes 2026-01-11 01:29:27 +00:00
jamesread 6493f7bee7 feat: block notifications, and cleanup of action/binding IDs 2026-01-11 01:10:20 +00:00
jamesread 661bcdda08 feat: #625 Option to save suggested values in the browser local storage across different args 2026-01-09 00:53:52 +00:00
jamesread e96270046e fix: (#765) set X-Accel-Buffering header to disable nginx buffering for event stream 2026-01-07 01:20:29 +00:00
James Read 3162b33ea9
feat: Enable/Disable actions based on rules (#817) 2026-01-07 00:47:18 +00:00
jamesread cbe6c8f20f core: dep update 2026-01-06 23:53:31 +00:00
jamesread c714dc0c62 chore: Webhooks fixes 2026-01-06 23:23:47 +00:00
jamesread 0368fb10db fix: wonky merge conflict, and missing body parameter from matcher 2026-01-06 22:15:37 +00:00
jamesread 5e9c5d2c17 Merge branch 'feat-webhooks' of github.com:OliveTin/OliveTin into feat-webhooks 2026-01-06 22:12:25 +00:00
jamesread 0b072db36d fix: Constant time comparison for webhook authentication 2026-01-06 22:11:41 +00:00
James Read 11278ff6c2
fix: Use constant-time comparison for Basic auth verification. 
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
 2026-01-06 22:09:17 +00:00
jamesread 3d5268d1c9 chore: enableExpression, broken test and config 2026-01-06 21:51:35 +00:00
jamesread f22b3953b1 feat: webhooks support 2026-01-06 21:45:55 +00:00
jamesread 654ed15dde fix: Add missing enabled expression file 2026-01-06 21:39:46 +00:00
jamesread 3e23fed3d6 feat: Enable/Disable actions based on rules 2026-01-06 21:38:18 +00:00
jamesread e9d90060fd chore: oauth gocyclo 2025-12-25 08:35:09 +00:00
James Read 257463997e
Merge branch 'next' into fix-argument-validation-on-bindings 2025-12-25 01:37:05 +00:00
jamesread 7e1a38eb9e feat: add AddToUsergroup option to OAuth2 providers 2025-12-25 01:36:05 +00:00
jamesread b4157ed5ba fix: argument validation on bindings 2025-12-25 01:16:04 +00:00
jamesread 2956b9972f chore: nil checks 2025-12-23 19:52:15 +00:00
jamesread 8e2db0ad82 chore: reduce argument validation complexity 2025-12-23 16:47:59 +00:00
jamesread 09e1f0f984 fix: Argument validation targets the bindings (fixes checkboxes, etc) 2025-12-23 16:42:00 +00:00
jamesread 5d061eb1a0 chore: service dep updates 2025-12-23 15:19:27 +00:00
James Read 75a696d8c0
Merge branch 'next' into dependabot/go_modules/service/next/github.com/bufbuild/buf-1.61.0 2025-12-01 22:18:25 +00:00
jamesread a2410fc9d6 feat: Entity directories, inline actions, and all entity fields are now available in the entity details view 2025-12-01 21:48:27 +00:00
jamesread 32fea4ec30 feat: Dashboard configs can now self-contain their entities, and actions all in one neat file 2025-12-01 16:15:08 +00:00
jamesread e58677e12c feat: inline actions on dashboards 2025-12-01 12:29:41 +00:00
jamesread 2e82a3d1ed chore: remove some dead code 2025-12-01 12:28:44 +00:00
dependabot[bot] e13a236e0a
chore(deps): bump github.com/bufbuild/buf in /service 
Bumps [github.com/bufbuild/buf](https://github.com/bufbuild/buf) from 1.60.0 to 1.61.0.
- [Release notes](https://github.com/bufbuild/buf/releases)
- [Changelog](https://github.com/bufbuild/buf/blob/main/CHANGELOG.md)
- [Commits](https://github.com/bufbuild/buf/compare/v1.60.0...v1.61.0)

---
updated-dependencies:
- dependency-name: github.com/bufbuild/buf
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-12-01 06:12:58 +00:00
jamesread 39009fcdd1 chore: code fmt 2025-12-01 01:59:10 +00:00
jamesread 56365af24b feat: Mega entity improvements - entity directories, inehrit entities (#450), ordering (#762 / #703), better entity view 2025-12-01 01:38:04 +00:00
jamesread 7425db53f6 fix: #718 - Clear OAuth2 authentication cookie on logout 2025-11-30 11:19:36 +00:00
jamesread 470f31db6e chore: Remove unecessary OAauth2 log 2025-11-27 00:41:53 +00:00
jamesread 8bad1b5400 fix: #703 - Entities order was non-deterministic 2025-11-27 00:02:08 +00:00
jamesread 7f1e509e12 chore: Little fixes for OAuth2 login 2025-11-26 23:28:29 +00:00
jamesread f33ccbd2fa fix: Log errors when loading theme CSS 2025-11-26 23:08:10 +00:00
jamesread e9bde8b094 fix: OAuth2 scopes for GitHub 2025-11-26 23:07:55 +00:00
jamesread 853972384c security: Possible to kill actions without authentication & credential leak in logs 2025-11-26 23:07:25 +00:00
jamesread be7c754043 feat: Rebuild authentication system to support 3k authentication 2025-11-26 22:33:19 +00:00
jamesread b244b42e91 fix: sort OAuth2 providers by key 2025-11-22 23:27:54 +00:00
jamesread 3d763a84df fix: Various oauth issues 2025-11-22 22:39:05 +00:00
jamesread 3e6a751132 chore: config-tool wont overwrite original config 2025-11-22 10:49:48 +00:00
James Read d2e7474eea
Merge branch 'next' into chore-add-config-tool 2025-11-22 09:47:14 +00:00
jamesread ca0a134acd chore: write back to the same config path in config-tool 2025-11-22 09:34:37 +00:00
jamesread 5bf2d6935b chore: dep update 2025-11-22 08:36:38 +00:00
jamesread b3e67bad75 doc: Add config tool to help support people 2025-11-16 23:08:20 +00:00
jamesread d1ec688c9a chore: cleanup executor.go 2025-11-16 00:47:03 +00:00
jamesread 5b57cf2480 fix: Logs were being displayed in the wrong order 2025-11-11 23:32:00 +00:00
jamesread 00d7285167 chore: fix some linting issues 2025-11-11 10:43:47 +00:00
jamesread 487bf83f4e chore: use koanf tag in config reloader test 2025-11-10 23:39:15 +00:00
jamesread 67a9d3b1d1 chore: skip env in config test in 3k 2025-11-10 23:17:53 +00:00
jamesread de7129e1d7 chore: reduce cyclomatic complexity 2025-11-10 23:15:18 +00:00
jamesread 83fe489949 fix: (#703) Fixed entity fieldsets being drawn in a random order 2025-11-10 21:08:34 +00:00
jamesread 3967b91cf0 fix: Exit if no base config file is found 2025-11-07 00:51:04 +00:00
James Read 110bbd6216
Merge branch 'next' into fix-config-loading-missing-values 2025-11-07 00:34:11 +00:00
jamesread 1552c104e9 fix: Propperly merge included configs (handling actions) 2025-11-07 00:31:33 +00:00
jamesread 7dc99b1398 fix: Massively improve config loading 2025-11-06 23:45:54 +00:00
jamesread 581536a60f fmt: GetActionLogs 2025-11-06 23:44:56 +00:00
jamesread 39664a734d fix: Various log noise 2025-11-06 23:42:07 +00:00
jamesread 822f3197b6 chore: (#675) Remove dead websocket code 2025-11-06 09:52:16 +00:00
jamesread 055472902d fix: #686 - concurrent map read and write - in entity instances 2025-11-04 23:30:14 +00:00
jamesread 2b24daa6d0 fix: Address concurrency issue in entities storage 2025-11-04 23:18:41 +00:00
jamesread 294e33d110 fix: #686 - concurrent map read and write 2025-11-04 23:03:45 +00:00
jamesread 83f45d71bf fix: Several coderabbit suggestions on next branch 2025-10-30 15:51:40 +00:00
jamesread 79a71099f9 fix: fmt api.go 2025-10-30 15:26:29 +00:00
jamesread e6a02ac614 chore: fix various cyclo checks 2025-10-30 15:25:57 +00:00
James Read 7abffedb14
Merge branch 'next' into fix-require-guests-login 2025-10-30 13:15:37 +00:00
jamesread 44b518a5b2 fix: panic when loading sessions.yaml 2025-10-30 13:04:41 +00:00