graham/towerops
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

remove C11 and C12 from bugs.md — not actual bugs

Browse source
This commit is contained in:
Graham McIntire 2026-05-12 10:24:15 -05:00
parent ca7bb75472
commit e96d077fdb
1 changed files with 0 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
bugs.md
View file

@ -180,30 +180,6 @@ tokens_to_expire = Repo.all_by(UserToken, user_id: user.id)
---
### C11. BY DESIGN — No `force_ssl` in Production
**File:** `config/prod.exs:41` — relies on Cloudflared proxy
**Severity:** CRITICAL — HTTP downgrade / cleartext traffic risk
**Description:** If Cloudflared is misconfigured, traffic arrives over plain HTTP with no redirect. No HSTS headers. Session cookies / API tokens sent in cleartext.
**Fix:** Enable `force_ssl: [hsts: true]` in production endpoint config.
---
### C12. FALSE POSITIVE — Race Condition in Device Quota Check
**Files:** `lib/towerops/devices.ex:539-578, 586-598`
**Severity:** CRITICAL — Concurrent device creation bypasses subscription limits
**Description:** `create_device` locks org row with `FOR UPDATE` but this doesn't serialize inserts into the `devices` table. Two concurrent calls both pass quota check (same count), then both insert.
**Fix:** Use `pg_advisory_xact_lock` keyed on `organization_id`, or move device count into the organization row.
---
### C13. ✓ FIXED — MikroTik Credentials Broadcast Over PubSub
**File:** `lib/towerops/workers/mikrotik_backup_worker.ex:95-98`