minecraft-ui/templates/instances, branch master

Config editor, host networking, whitelist RCON

2026-07-29T10:21:32Z

- Config file editor at /instances/{id}/config (browse & edit config/ files) - Host networking for Docker container (fixes WireGuard MTU DNS issues) - Whitelist changes applied live via RCON instead of stopping the server - Config edit handler detects which fields changed: whitelist → RCON, other settings → restart container - walk_dir simplified (removed unused root param) - import_world uses if-let instead of never-looping while-let - docker-compose.yml updated as reference template

Security audit fixes: patch 16 vulnerabilities across 7 source files

2026-07-29T00:24:41Z

CRITICAL: - Instance name path traversal (AP-001): sanitize::sanitize_instance_name() strips .., /, \, \0, spaces, special chars at all 12 join call sites - Zip-slip protection in world import: starts_with() guard after enclosed_name() HIGH: - RCON command injection: validate_username() rejects non-MC usernames across all 6 player action macros (whitelist, op, ban) - Level-seed properties injection: sanitize_seed() strips \n \r = : \0 - CSRF protection: SameSite=Lax -> SameSite=Strict on session cookie MEDIUM: - Session TTL: server-side 24h expiry via strftime check in require_auth - Rate limiting: in-memory 10-ip/5min sliding window on login - Background task stale is_active: all queries use concrete WHERE id=?1 - Mod validation DoS: 500MB cap, 10k class scan limit, 10k CP entry cap LOW: - Logout auth guard: moved into protected route group + CurrentUser param - Mod orphan race: DB insert before file write - Backup orphan race: DB insert before ZIP creation - Template fix: broken Askama == comparisons in edit.html All fixes compile clean with zero warnings. 10 unit tests pass.

Add per-instance mod management with client-side detection

2026-07-28T23:03:24Z

- New mod validation engine (src/mods.rs) with constant-pool class-file scanning: detects server-side content (block, tileentity, command, worldgen) vs client-only API (gui, renderer, forge/client) - 7 client-only mods correctly detected (AppleSkin, CraftingTweaks, Durability101, EnchantmentDescriptions, InventoryHUD, MouseTweaks, TrashSlot); 51 server-capable; 1 unknown - Routes + templating for mod upload (jar/zip), listing, delete, rescan - Multipart upload with 500MB limit (bypasses axum's default 2MB) - Per-instance mod summary card on edit page - Whitelist toggle checkbox on edit page (persisted, drives ENABLE_WHITELIST) - Dynamic Java image tag (java8/java17/java21) based on MC version - Class scan is informational-only; rejection based on metadata side=CLIENT - has_modpack flag cleanup on mod delete - Remove hx-boost from (was corrupting multipart uploads)

remove unused code, also, third stable

2026-07-12T20:06:54Z

second stable

2026-07-12T19:35:25Z

first stable

2026-07-12T17:38:03Z