This repository was archived by the owner on Jul 28, 2026. It is now read-only.
Conversation
…ost.org/assets/picto.png
- Added closePool() export in config/db.js to properly close MariaDB pool - Added stopScheduler() in services/scheduler.js with timer cleanup - Added graceful shutdown handler in server.js to close server, pool, and scheduler - Added forced shutdown after 10s timeout for safety - Removed process.exit(1) from unhandledRejection/uncaughtException to prevent abrupt termination; errors are logged but process continues
- Added X-Request-Id header to all responses using crypto.randomUUID() - Included requestId in error responses for troubleshooting - Updated error logs to include request ID for correlation - Added requestId to health check responses
- Added activityLimiter (30 req/min) to /api/activity endpoint - Prevents rapid polling of activity logs by clients
- Added MAX_EMAIL_LENGTH, MAX_USERNAME_LENGTH, MAX_PASSWORD_LENGTH constants - Added type validation for email, username, password in register route - Added max length enforcement for all text inputs - Prevents abuse through excessively large input fields
- Added resolve() checks to prevent directory traversal in avatar serving - Added resolve() checks to avatar upload path - Added file extension whitelist validation before saving - Prevents reading/writing files outside the upload directory
- Added token_version +1 on password change to invalidate all existing JWT tokens - Prevents compromised tokens from remaining valid after password change
- Added pingTimeout to pool config for connection keep-alive - Added getPoolStatus() export to monitor active/total/idle connections - Updated health endpoint to expose pool statistics - Helps detect connection leaks and pool health issues
- Added adminLoginLimiter (10 req/15min) to prevent brute force on admin login - Added notifyAllLimiter (5 req/hour) to prevent notification spam - Removed duplicate query import
- Added type validation for notification title/message fields - Added max-length enforcement for title (255) and message (5000) - Added input sanitization for suspend reason (max 500 chars) - Added numeric validation for egg resource limits (non-negative) - Added type validation for nest name updates
- Added escapeHtml() utility function to safely escape user data - Escaped notification titles and messages in panels and modals - Escaped activity log details in renderLog() - Escaped server names and usernames in server cards and pages - Escaped user data in admin panels (usernames, emails, server names) - Prevents stored XSS attacks through notification and profile data
- Added REQUIRED_ENV_VARS check in server.js to fail fast on missing config - Added JWT_SECRET shell expansion detection at startup - Removed duplicate dotenv import from config/db.js - Removed redundant env checks from middleware/auth.js and config/cap.js - Prevents runtime errors from missing configuration
- Added sensitiveLimiter (5 req/15min) to change-password, change-email, and delete-account routes - Added notification ID validation (positive integer check) - Prevents brute force attacks on account-sensitive operations
- Added automatic cache cleanup timer to prevent memory leaks - Added MAX_PAGES (20) limit to all paginated API calls to prevent runaway requests on large panels - Cache now cleans stale entries automatically every CACHE_TTL interval
- Added type validation and allowed character whitelist for server names - Added regex validation to prevent special characters in server names - Added power signal validation (start/stop/restart/kill only) - Added API key length validation - Added rate limiting on server creation (3 req/hour) and rename (10 req/hour) - Prevents injection attacks and abuse of server operations
- Added renewLimiter (5 req/hour) to prevent abuse of server renewal - Added reinstallLimiter (2 req/day) to limit destructive server reinstalls - Prevents resource exhaustion from repeated server operations
- Added in-memory failed login attempt tracking per IP - Added incremental delay (1s to 10s) based on failed attempt count - Added automatic cleanup of stale entries every 60s to prevent memory leaks - Applied delay to login and register endpoints - Records successful and failed login/register attempts - Rate limiting works alongside existing express-rate-limit for defense in depth
- Added cleanupOldNotifications() to delete read notifications older than 90 days - Added cleanupOldActivityLogs() to delete activity logs older than 90 days - Both run at scheduler startup and nightly alongside server suspension checks - Prevents unbounded database growth and maintains query performance
…equest timeout - Added upgradeInsecureRequests directive to CSP for automatic HTTPS upgrade - Added per-IP concurrent request limiter (max 20) to prevent connection exhaustion - Added 30-second request timeout to prevent slow loris attacks - Added X-Content-Type-Options: nosniff header to all responses
- Applied authLimiter (20 req/15min) to all /api/notifications routes - Prevents abuse of notification marking and listing endpoints
…y parsing - Added express.urlencoded parser with size limit for form data handling - Added JSON SyntaxError handler to return proper 400 error instead of crash - Added HTTP method restriction middleware (only GET/POST/PUT/PATCH/DELETE allowed) - Prevents server crashes from malformed JSON requests
- Added circuit breaker pattern that opens after 10 errors in 60s window - Added timeout error retry with exponential backoff (previously only 429 retries) - Prevents cascading failures when the Pterodactyl API is unreachable - Auto-resets the circuit breaker as errors age out of the window
- Added X-Frame-Options: SAMEORIGIN to prevent clickjacking - Added X-Robots-Tag: noindex, nofollow to prevent search indexing - These headers complement helmet's existing protections
- Added 30-second query timeout via Promise.race to prevent hung queries - Added proper cleanup of timeout timer in error and success paths - Prevents connection pool exhaustion from stalled database queries
- Added adminApiLimiter (60 req/min) for all authenticated admin routes - Added input type validation to admin login route (string type check) - Prevents abuse of admin API endpoints and ensures proper input types
- Enforces application/json content-type for POST/PUT/PATCH requests - Returns 415 Unsupported Media Type for invalid content types - Prevents processing of unexpected content types from API consumers
…scription management - Add wizard UI: Nest cards -> Egg selection -> Server name -> Summary - Nest/egg cards with logo, title, description from DB - Admin panel: edit nest logo/description, egg logo with live preview - New DB columns: nests.logo, nests.description, egg_resources.logo - New API: GET /api/servers/nests for wizard data - Admin API: PUT nests/:id supports logo+description, PUT eggs supports logo
Merge pull request #13 from ZeroHost-Code/beta
…-dropdown instead of parent .custom-select
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.