v1.0.5#22

Merged

ddrayko merged 52 commits into

mainfrom

Jul 11, 2026

Commits on Jul 10, 2026

fix(critical): prevent SQL injection via PANEL_DB_NAME by backtick-quoting and centralizing definition
ddrayko
committed
fix(critical): remove 'unsafe-eval' from CSP to prevent XSS via code injection
ddrayko
committed
fix(critical): prevent attacker-controlled lookup in WebAuthn challenge map by keying on userId/sessionToken instead of client-supplied challenge
ddrayko
committed
fix(high): add progressive login delay to admin login to prevent brute-force attacks
ddrayko
committed
fix(high): bump token_version on email change to invalidate existing sessions
ddrayko
committed
fix(high): apply progressive login delay only after CAPTCHA/password validation to prevent resource exhaustion
ddrayko
committed
fix(high): add ownership verification for resources and power endpoints to prevent unauthorized server access
ddrayko
committed
fix(high): invalidate all sessions on logout by bumping token_version
ddrayko
committed
fix(medium): sanitize activity log details to prevent log injection and HTML injection
ddrayko
committed
fix(medium): add rate limiting to all passkey endpoints to prevent brute-force and abuse
ddrayko
committed
fix(medium): remove verbose error messages from API responses to prevent information leakage in production
ddrayko
committed
fix(medium): add audit logging to admin CLI operations for accountability
ddrayko
committed
fix(critical): restrict CORS origins in development mode to prevent cross-origin credential theft
ddrayko
committed
fix(critical): prevent SQL injection in requireOwnership middleware by enforcing table/column whitelist
ddrayko
committed
Merge pull request #21 from ZeroHost-Code/security-update
ddrayko
authored
fix: add missing PANEL_DB_NAME export from services/pyrodactyl.js for admin.js import
ddrayko
committed
fix: import randomBytes from crypto instead of using crypto.randomBytes (not a function)
ddrayko
committed
fix: add wasm-unsafe-eval to CSP for cap-widget WebAssembly, handle passkey autofill without sessionToken
ddrayko
committed
fix: suppress 4xx error logging from Pterodactyl API (callers handle gracefully), fix rename endpoint path
ddrayko
committed
fix: init Lucide icons on login page so passkey fingerprint SVG appears immediately instead of requiring a click+dismiss cycle
ddrayko
committed
fix: inline fingerprint SVG directly instead of relying on Lucide dynamic replacement (resolves icon not showing on login page)
ddrayko
committed
fix: add initIcons() with fallback timeout in renderLoginPage, bump cache version to force refresh
ddrayko
committed
fix: add 'unsafe-eval' to CSP script-src for cap-widget instrumentation
ddrayko
committed
switch GH Actions from password to SSH key auth
ddrayko
committed
chore: trigger deploy
ddrayko
committed
feat: complete mobile responsive redesign
ddrayko
committed
fix: improve /create wizard and notification panel mobile layout
ddrayko
committed
fix: close sidebar on mobile when opening notification panel
ddrayko
committed
fix: hide wizard progress bar on mobile
ddrayko
committed
fix: notif panel full width on phones only, fixed on tablets
ddrayko
committed
fix: mobile notif panel shows X close button instead of Mark all read
ddrayko
committed
fix: notif panel uses max-width to prevent overflow on all screens
ddrayko
committed
fix: notif panel full width on mobile
ddrayko
committed
fix: reset notif panel left position on mobile
ddrayko
committed
fix: hide wizard progress bar on mobile (override after base styles)
ddrayko
committed
fix: hide create page header text on mobile
ddrayko
committed
fix: force hide create page header on mobile (inline style override)
ddrayko
committed
fix: disable sidebar collapse on logo click on mobile
ddrayko
committed

Commits on Jul 11, 2026