minecraft-ui, branch master

small changes

2026-08-04T12:05:15Z

Config editor, host networking, whitelist RCON

2026-07-29T10:21:32Z

- Config file editor at /instances/{id}/config (browse & edit config/ files) - Host networking for Docker container (fixes WireGuard MTU DNS issues) - Whitelist changes applied live via RCON instead of stopping the server - Config edit handler detects which fields changed: whitelist → RCON, other settings → restart container - walk_dir simplified (removed unused root param) - import_world uses if-let instead of never-looping while-let - docker-compose.yml updated as reference template

Enable/disable mods, batch toggle & delete

2026-07-29T09:19:12Z

- Add column to mods table (auto-migrated) - Toggle endpoint: rename .jar ↔ .jar.disabled on disk, flip DB flag - Batch toggle & delete with checkboxes + JS helper (fixes nested-form bug) - Raw Vec<(String,String)> form deserialization fixes 'duplicate field' error - Batch action bars at top and bottom of mod list - Uploads default to enabled=1, rescan skips .jar.disabled files

Mod picker: allow selecting multiple .jar files for upload

2026-07-29T00:26:49Z

Add 'multiple' attribute to the file input so users can pick several .jar files at once from their filesystem without needing to zip them. The backend already processes each multipart field independently.

Security audit fixes: patch 16 vulnerabilities across 7 source files

2026-07-29T00:24:41Z

CRITICAL: - Instance name path traversal (AP-001): sanitize::sanitize_instance_name() strips .., /, \, \0, spaces, special chars at all 12 join call sites - Zip-slip protection in world import: starts_with() guard after enclosed_name() HIGH: - RCON command injection: validate_username() rejects non-MC usernames across all 6 player action macros (whitelist, op, ban) - Level-seed properties injection: sanitize_seed() strips \n \r = : \0 - CSRF protection: SameSite=Lax -> SameSite=Strict on session cookie MEDIUM: - Session TTL: server-side 24h expiry via strftime check in require_auth - Rate limiting: in-memory 10-ip/5min sliding window on login - Background task stale is_active: all queries use concrete WHERE id=?1 - Mod validation DoS: 500MB cap, 10k class scan limit, 10k CP entry cap LOW: - Logout auth guard: moved into protected route group + CurrentUser param - Mod orphan race: DB insert before file write - Backup orphan race: DB insert before ZIP creation - Template fix: broken Askama == comparisons in edit.html All fixes compile clean with zero warnings. 10 unit tests pass.

Add per-instance mod management with client-side detection

2026-07-28T23:03:24Z

- New mod validation engine (src/mods.rs) with constant-pool class-file scanning: detects server-side content (block, tileentity, command, worldgen) vs client-only API (gui, renderer, forge/client) - 7 client-only mods correctly detected (AppleSkin, CraftingTweaks, Durability101, EnchantmentDescriptions, InventoryHUD, MouseTweaks, TrashSlot); 51 server-capable; 1 unknown - Routes + templating for mod upload (jar/zip), listing, delete, rescan - Multipart upload with 500MB limit (bypasses axum's default 2MB) - Per-instance mod summary card on edit page - Whitelist toggle checkbox on edit page (persisted, drives ENABLE_WHITELIST) - Dynamic Java image tag (java8/java17/java21) based on MC version - Class scan is informational-only; rejection based on metadata side=CLIENT - has_modpack flag cleanup on mod delete - Remove hx-boost from (was corrupting multipart uploads)

create example config on startup

2026-07-12T20:09:01Z

remove unused code, also, third stable

2026-07-12T20:06:54Z

second stable

2026-07-12T19:35:25Z

first stable

2026-07-12T17:38:03Z