novacpx

mirror of https://github.com/myronblair/novacpx synced 2026-06-30 17:50:41 -05:00

Files

T

myron 956defc34b fix: all code review security findings

- CORS: replace open regex with explicit hostname allowlist + port whitelist
- Exception handler: only expose RuntimeException/InvalidArgumentException
  messages; PDOException and others return generic 'internal error'
- Auth::portalUrl(): allowlist-validate HTTP_HOST before using it in
  redirect URL — prevents open redirect via Host header injection
- _branding.php custom_css: strip HTML tags, js: URLs, @import, expression()
  instead of just </style> which was trivially bypassable
- accounts create: check accounts table as well as users for username
  uniqueness (TOCTOU fix); wrap user INSERT + provisioning in single
  transaction so rollback is atomic on failure

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LP9Q4kfCAYAjJnsbHBrViZ

2026-06-21 16:03:26 +00:00

AccountManager.php

fix: remove php-fpm pool on account creation rollback to prevent fpm crash

2026-06-20 16:39:48 +00:00

Auth.php

fix: all code review security findings

2026-06-21 16:03:26 +00:00

BackupManager.php

Fix multiple user panel 500 errors

2026-06-09 18:32:10 +00:00

CloudflareManager.php

feat: items #9-13 — password change, webmail SSO, DKIM live, file manager security, cache busting