Oxicloud

Author	SHA1	Message	Date
SAY-5	b9af3092be	chore: remove em-dashes from comments	2026-06-09 15:11:16 -07:00
Edouard Vanbelle	21c06da700	feat(magic-links): add rate limiting + archirecture documentation	2026-06-03 00:32:00 +02:00
Edouard Vanbelle	8e1a738056	feat(audit): show trace with HTTP's client_ip and user if logged in + add support of trusted proxy via CIDR	2026-05-05 09:44:25 +02:00
Edouard Vanbelle	badf35f08f	chore: remove all executable attributes on non bash files	2026-04-01 23:14:42 +02:00
Diocrafts	9f08460027	perf: OnceLock for env var, Arc<CurrentUser> in auth, pre-compute query lowercase - rate_limit: cache OXICLOUD_TRUST_PROXY_HEADERS in OnceLock<bool> to avoid syscall on every request (~500ns → ~1ns) - auth middleware: insert Arc<CurrentUser> instead of bare CurrentUser; all 5 extractors now clone Arc (~1ns) instead of 4 Strings (~60-100ns) - search_service: pre-compute query.to_lowercase() once before loops, eliminating N redundant heap allocations per search	2026-03-07 11:23:56 +01:00
Dionisio	f2d35ca792	feat: auto-persist JWT secret, remove setup token requirement - JWT secret auto-generates and persists to <STORAGE_PATH>/.jwt_secret - Remove setup token: first admin setup is open until system initialized - Fix schema.sql: move CREATE EXTENSION pg_trgm/ltree to top - Update login UI and auth.js to remove setup token fields	2026-03-05 22:12:53 +01:00
Dionisio	33cfb0faef	fix: security audit — patch vulnerabilities V-02 through V-16 - V-02: XSS via innerHTML in profile.js — wrap err.message in escapeHtml() - V-03: IDOR upload to other users' folders — add folder ownership check - V-04: IDOR create folders in other users' trees — add parent ownership check - V-06: Content-Disposition header injection — RFC 5987 percent-encoding - V-08: WebDAV MOVE/COPY destination without ownership — add assert_owner checks - V-09: .gitignore missing cert/key patterns — add .pem, .key, *.p12, etc. - V-11: Username accepts XSS payloads — restrict to [a-zA-Z0-9._-] - V-12: Minimal email validation — reject forbidden chars, require domain dot - V-13: admin_reset_password doesn't invalidate sessions — revoke all sessions - V-14: Rate limiting bypassable via X-Forwarded-For — gate behind OXICLOUD_TRUST_PROXY_HEADERS - V-15: Cookie Secure flag off by default — default to true (safe-by-default) - V-16: LIKE wildcard injection in searches — add like_escape() helper across 9 sites	2026-03-05 14:52:11 +01:00
Diocrafts	ee86c3a128	fix: resolve all clippy warnings and convert integration_tests to custom cfg - Add type aliases (FileRow, FolderRow, FolderRowPaginated, FolderRowOptUser) to reduce type complexity - Simplify redundant closures in app_password_handler and webdav_handler - Remove needless borrow in auth_handler - Collapse nested if/let chains in login_lockout, webdav_lock, auth, rate_limit - Box LockEntry in acquire() Err variant to fix large enum variant warning - Rename DeviceCodeStatus::from_str to parse to avoid should_implement_trait lint - Add #[allow(clippy::too_many_arguments)] and #[allow(clippy::result_unit_err)] where appropriate - Convert integration_tests from cargo feature to custom cfg attribute - Add check-cfg lint config in Cargo.toml for integration_tests cfg	2026-03-04 23:55:08 +01:00
Dionisio	efcf88c4d7	style: cargo fmt --all	2026-03-03 01:49:18 +01:00
Dionisio	1df52fd702	security: add IP rate limiting + account lockout on auth endpoints - Rate limit login (5/min), register (3/hr), refresh (10/min) per IP - Account lockout after 5 consecutive failed logins (15 min cooldown) - Fix stored XSS in admin panel (escapeHtml on all user-controlled data) - All limits configurable via OXICLOUD_RATE_LIMIT_* / OXICLOUD_LOCKOUT_* env vars - Zero new dependencies (uses existing moka crate for in-memory caches) - Includes unit tests for lockout service	2026-03-03 01:44:39 +01:00

10 Commits