enricobuehler ff33eb872e fix(web): gate PUT /api/v1/library/provider/{p} behind the console password ...

security-review 2026-08-15 finding 6. confirmIfCommandExecution was wired into
only the two custom-entry routes; the provider reconcile route had no BFF handler
and fell through to the /api/** catch-all, which injects the full admin bearer —
so a bare session cookie could plant a persistent prep/launch.kind:command entry
without the password. Add the missing handler so it runs the same
command-execution gate before forwarding (an ordinary catalog reconcile is
untouched).

2026-08-15 10:48:17 +02:00

..

middleware

fix(web/plugins): a plugin's interface loads again, instead of an empty panel

2026-08-06 22:33:57 +02:00

routes

fix(web): gate PUT /api/v1/library/provider/{p} behind the console password

2026-08-15 10:48:17 +02:00

util

feat(host): moving the management port off 47990 now survives, and the console follows

2026-08-14 19:44:19 +02:00