Juan DenisandCaptBoykin 5bc3f26d77 fix(security): block panel-internal paths from the file manager (GHSA-rm3m-9mvw-68fh) ...

The 1.7.68 RBAC fix enforced files.read on read endpoints, but the default
viewer role legitimately has files.read=true, and on the documented
install.sh layout the panel install dir (/opt/serverkit) sits under the
allowed root /opt. A viewer could read the backend .env, steal
JWT_SECRET_KEY / SERVERKIT_ENCRYPTION_KEY, and forge admin sessions.

FileService now carries PROTECTED_ROOTS (the panel install dir and
SERVERKIT_CONFIG_DIR), checked inside is_path_allowed before the
ALLOWED_ROOTS test, so every file-manager operation (read, write, browse,
download, upload, ...) refuses panel-internal paths for every role.

Regression tests: protected paths rejected by is_path_allowed; viewer
read/download of the backend .env returns 403; allowed roots keep working.

Co-authored-by: CaptBoykin <CaptBoykin@users.noreply.github.com>

2026-08-02 17:21:02 -04:00

..

app

fix(security): block panel-internal paths from the file manager (GHSA-rm3m-9mvw-68fh)

2026-08-02 17:21:02 -04:00

migrations

fix(monitoring): give the TLS certificate read its own clock

2026-07-28 00:22:56 -04:00

serverkit_installer

docs: adopt numbered filenames for docs/plans and update references

2026-07-01 20:49:41 -04:00

templates

docs(screenshots): recapture, and fix two bugs the capture exposed

2026-07-26 09:59:06 -04:00

tests

fix(security): block panel-internal paths from the file manager (GHSA-rm3m-9mvw-68fh)

2026-08-02 17:21:02 -04:00

_dbcheck.py

Add test sandbox and harden install scripts

2026-07-20 22:26:19 -04:00

.bandit

Add dev launcher; harden backups & storage

2026-03-02 22:48:29 -05:00

.dockerignore

Compose: containerize backend & build frontend

2026-03-01 14:30:21 -05:00

.env.example

Add review rules and proxy/auth docs

2026-07-18 01:23:47 -04:00

.gitignore

Add dev launcher; harden backups & storage

2026-03-02 22:48:29 -05:00

cli.py

feat(cli): --json output on read-only admin CLI verbs

2026-07-11 01:22:49 -04:00

config.py

feat(deployments): simulated demo deploys through the real console pipeline

2026-07-23 16:58:46 -04:00

Dockerfile

fix(deploy): make docker-compose.yml frontend-only (backend runs on host)

2026-06-25 16:20:32 -04:00

requirements.txt

Add pip-audit CI gate and bump click

2026-07-20 02:16:47 -04:00

run.py

Add unified dev scripts and improve login UX

2026-01-25 18:33:25 -05:00

serverkit_cron_run.py

feat(cron): completion — run history, project scope, cwd/run-as (plan 34)

2026-07-07 20:29:29 -04:00

smoke_sandbox.py

Add test sandbox and harden install scripts

2026-07-20 22:26:19 -04:00

wp-cli.phar

Add multi-site WordPress management and UI overhaul

2026-01-28 22:15:57 -05:00