Juan DenisandAruvasgaChithan 696226002b fix(security): enforce files.write permission on File Manager mutations (GHSA-4wqh-7f4f-5qmx) ...

Mutating File Manager endpoints (write/create/mkdir/delete/rename/copy/
move/chmod/upload and the S3 equivalents) only required a valid JWT, so a
viewer account (files.write=false) could write and delete files. They now
require the files.write permission via permission_required(). Read
endpoints are unchanged. Adds regression tests covering both advisories.

Co-authored-by: AruvasgaChithan <AruvasgaChithan@users.noreply.github.com>

2026-07-26 15:19:22 -04:00

..

app

fix(security): enforce files.write permission on File Manager mutations (GHSA-4wqh-7f4f-5qmx)

2026-07-26 15:19:22 -04:00

migrations

feat(dashboard): boards that survive the browser they were built in

2026-07-25 19:30:51 -04:00

serverkit_installer

docs: adopt numbered filenames for docs/plans and update references

2026-07-01 20:49:41 -04:00

templates

docs(screenshots): recapture, and fix two bugs the capture exposed

2026-07-26 09:59:06 -04:00

tests

fix(security): enforce files.write permission on File Manager mutations (GHSA-4wqh-7f4f-5qmx)

2026-07-26 15:19:22 -04:00

_dbcheck.py

Add test sandbox and harden install scripts

2026-07-20 22:26:19 -04:00

.bandit

Add dev launcher; harden backups & storage

2026-03-02 22:48:29 -05:00

.dockerignore

Compose: containerize backend & build frontend

2026-03-01 14:30:21 -05:00

.env.example

Add review rules and proxy/auth docs

2026-07-18 01:23:47 -04:00

.gitignore

Add dev launcher; harden backups & storage

2026-03-02 22:48:29 -05:00

cli.py

feat(cli): --json output on read-only admin CLI verbs

2026-07-11 01:22:49 -04:00

config.py

feat(deployments): simulated demo deploys through the real console pipeline

2026-07-23 16:58:46 -04:00

Dockerfile

fix(deploy): make docker-compose.yml frontend-only (backend runs on host)

2026-06-25 16:20:32 -04:00

requirements.txt

Add pip-audit CI gate and bump click

2026-07-20 02:16:47 -04:00

run.py

Add unified dev scripts and improve login UX

2026-01-25 18:33:25 -05:00

serverkit_cron_run.py

feat(cron): completion — run history, project scope, cwd/run-as (plan 34)

2026-07-07 20:29:29 -04:00

smoke_sandbox.py

Add test sandbox and harden install scripts

2026-07-20 22:26:19 -04:00

wp-cli.phar

Add multi-site WordPress management and UI overhaul

2026-01-28 22:15:57 -05:00