graham/towerops
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
towerops/lib/towerops_web/plugs
History
Graham McIntire ca7bb75472 fix: 11 critical security/correctness bugs from code audit 
- C1: Replace innerHTML template literals with DOM textContent in sites_map.ts
- C2: Derive user_id from current_scope instead of client params in policy consent
- C3: Fix broken halt() in GDPR data export (orphaned _ = ... halt())
- C4: Add owner/admin authorization check to MembersController update/delete
- C5: Require HMAC signature on agent release webhook (was optional)
- C6: Fix Repo.all_by/2 (not a real Ecto function) → Repo.all with query
- C7: Move auth exemption to before_send callback in BruteForceProtection
- C8: Block </style>/<script injection in status page custom_css validation
- C9: Create secrets.example.yaml with placeholders; secrets.yaml already gitignored
- C10: Load Stripe key from STRIPE_SECRET_KEY env var instead of hardcoded value
- C13: Remove credentials from PubSub backup broadcast; channel resolves them

C11 (no force_ssl): by design — Cloudflared terminates TLS
C12 (device quota race): false positive — FOR UPDATE serializes correctly
2026-05-12 10:20:52 -05:00
..
api_auth.ex refactor: use API token auth for profile imports instead of session cookies 2026-01-18 09:30:21 -06:00
brute_force_protection.ex fix: 11 critical security/correctness bugs from code audit 2026-05-12 10:20:52 -05:00
capture_timezone.ex Use detected timezone from session in user registration 2026-02-01 12:18:33 -06:00
check_policy_consent.ex gdpr consent tracking 2026-01-29 11:12:35 -06:00
detect_eu_user.ex fix: remaining bugs.md findings — Repo calls, process dict, CSS, rate limits, Oban, debug route 2026-05-11 19:34:18 -05:00
filter_noisy_logs.ex fix: properly disable Plug.Telemetry logging for health checks 2026-03-08 16:39:26 -05:00
graphql_auth.ex perf+refactor: codebase-wide query and antipattern audit 2026-04-28 16:58:51 -05:00
graphql_introspection.ex Security fixes: mask credentials in logs/API, fix cookie/CSP/LIKE injection/webhooks 2026-02-15 09:09:04 -06:00
markdown_negotiation.ex fix: correct login URL path in markdown negotiation content 2026-04-17 15:50:31 -05:00
mobile_auth.ex perf+refactor: codebase-wide query and antipattern audit 2026-04-28 16:58:51 -05:00
rate_limit.ex fix: remaining bugs.md findings — Repo calls, process dict, CSS, rate limits, Oban, debug route 2026-05-11 19:34:18 -05:00
remote_ip_logger.ex perf: disable Req retry for faster error tests 2026-03-10 16:19:31 -05:00
security_headers.ex fix: API token access control, admin form crash, MIB validation, CSP dedup 2026-05-12 09:08:57 -05:00
update_session_activity.ex perf+refactor: codebase-wide query and antipattern audit 2026-04-28 16:58:51 -05:00
webhook_auth.ex fix: address security and reliability findings from bugs.md review 2026-05-11 18:54:12 -05:00