graham/towerops
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
towerops/lib/towerops_web/controllers/api/v1
History
Graham McIntire ca7bb75472 fix: 11 critical security/correctness bugs from code audit 
- C1: Replace innerHTML template literals with DOM textContent in sites_map.ts
- C2: Derive user_id from current_scope instead of client params in policy consent
- C3: Fix broken halt() in GDPR data export (orphaned _ = ... halt())
- C4: Add owner/admin authorization check to MembersController update/delete
- C5: Require HMAC signature on agent release webhook (was optional)
- C6: Fix Repo.all_by/2 (not a real Ecto function) → Repo.all with query
- C7: Move auth exemption to before_send callback in BruteForceProtection
- C8: Block </style>/<script injection in status page custom_css validation
- C9: Create secrets.example.yaml with placeholders; secrets.yaml already gitignored
- C10: Load Stripe key from STRIPE_SECRET_KEY env var instead of hardcoded value
- C13: Remove credentials from PubSub backup broadcast; channel resolves them

C11 (no force_ssl): by design — Cloudflared terminates TLS
C12 (device quota race): false positive — FOR UPDATE serializes correctly
2026-05-12 10:20:52 -05:00
..
activity_controller.ex feat: expand REST API with alerts, agents, org settings, members, integrations, metrics, activity endpoints 2026-02-14 11:28:57 -06:00
agent_release_webhook_controller.ex fix: 11 critical security/correctness bugs from code audit 2026-05-12 10:20:52 -05:00
agents_controller.ex fix: resolve compilation errors, test failures, and credo issues 2026-02-14 12:23:10 -06:00
alerts_controller.ex fix: resolve compilation errors, test failures, and credo issues 2026-02-14 12:23:10 -06:00
check_results_controller.ex reliability-audit-fixes (#181) 2026-03-26 14:10:36 -05:00
checks_controller.ex dialyzer: fix all unmatched_return warnings (154 → 0) 2026-04-21 10:03:55 -05:00
coverages_controller.ex feat(coverage): public REST API + KMZ export + email-on-complete 2026-05-06 17:15:57 -05:00
devices_controller.ex dialyzer: fix all unmatched_return warnings (154 → 0) 2026-04-21 10:03:55 -05:00
escalation_policies_controller.ex fix: address security and reliability findings from bugs.md review 2026-05-11 18:54:12 -05:00
gaiia_webhook_controller.ex refactor(webhooks): enqueue Oban jobs immediately, ACK fast 2026-05-10 17:18:23 -05:00
geoip_controller.ex dialyzer: fix remaining 88 warnings — clean dialyzer run 2026-04-21 10:32:42 -05:00
integrations_controller.ex perf+refactor: codebase-wide query and antipattern audit 2026-04-28 16:58:51 -05:00
invitations_controller.ex fix: resolve compilation errors, test failures, and credo issues 2026-02-14 12:23:10 -06:00
maintenance_windows_controller.ex add maintenance windows REST API and GraphQL support 2026-03-11 14:33:25 -05:00
members_controller.ex fix: 11 critical security/correctness bugs from code audit 2026-05-12 10:20:52 -05:00
mib_controller.ex fix: API token access control, admin form crash, MIB validation, CSP dedup 2026-05-12 09:08:57 -05:00
mikrotik_webhook_controller.ex feat(mikrotik): webhook receiver for MikroTik RouterOS events 2026-05-11 18:02:21 -05:00
organization_controller.ex fix: use correct auth check for API organization updates 2026-03-10 13:41:38 -05:00
pagerduty_webhook_controller.ex refactor(webhooks): enqueue Oban jobs immediately, ACK fast 2026-05-10 17:18:23 -05:00
schedules_controller.ex fix: address security and reliability findings from bugs.md review 2026-05-11 18:54:12 -05:00
sites_controller.ex Refactor duplicate site API logic 2026-03-10 16:27:35 -05:00
stripe_webhook_controller.ex refactor(webhooks): enqueue Oban jobs immediately, ACK fast 2026-05-10 17:18:23 -05:00