| Commit message (Collapse) | Author | Files | Lines |
|---|
|
- Add column to mods table (auto-migrated)
- Toggle endpoint: rename .jar ↔ .jar.disabled on disk, flip DB flag
- Batch toggle & delete with checkboxes + JS helper (fixes nested-form bug)
- Raw Vec<(String,String)> form deserialization fixes 'duplicate field' error
- Batch action bars at top and bottom of mod list
- Uploads default to enabled=1, rescan skips .jar.disabled files
|
|
Add 'multiple' attribute to the file input so users can pick several
.jar files at once from their filesystem without needing to zip them.
The backend already processes each multipart field independently.
|
|
CRITICAL:
- Instance name path traversal (AP-001): sanitize::sanitize_instance_name()
strips .., /, \, \0, spaces, special chars at all 12 join call sites
- Zip-slip protection in world import: starts_with() guard after enclosed_name()
HIGH:
- RCON command injection: validate_username() rejects non-MC usernames
across all 6 player action macros (whitelist, op, ban)
- Level-seed properties injection: sanitize_seed() strips \n \r = : \0
- CSRF protection: SameSite=Lax -> SameSite=Strict on session cookie
MEDIUM:
- Session TTL: server-side 24h expiry via strftime check in require_auth
- Rate limiting: in-memory 10-ip/5min sliding window on login
- Background task stale is_active: all queries use concrete WHERE id=?1
- Mod validation DoS: 500MB cap, 10k class scan limit, 10k CP entry cap
LOW:
- Logout auth guard: moved into protected route group + CurrentUser param
- Mod orphan race: DB insert before file write
- Backup orphan race: DB insert before ZIP creation
- Template fix: broken Askama == comparisons in edit.html
All fixes compile clean with zero warnings. 10 unit tests pass.
|
|
- New mod validation engine (src/mods.rs) with constant-pool class-file
scanning: detects server-side content (block, tileentity, command,
worldgen) vs client-only API (gui, renderer, forge/client)
- 7 client-only mods correctly detected (AppleSkin, CraftingTweaks,
Durability101, EnchantmentDescriptions, InventoryHUD, MouseTweaks,
TrashSlot); 51 server-capable; 1 unknown
- Routes + templating for mod upload (jar/zip), listing, delete, rescan
- Multipart upload with 500MB limit (bypasses axum's default 2MB)
- Per-instance mod summary card on edit page
- Whitelist toggle checkbox on edit page (persisted, drives ENABLE_WHITELIST)
- Dynamic Java image tag (java8/java17/java21) based on MC version
- Class scan is informational-only; rejection based on metadata side=CLIENT
- has_modpack flag cleanup on mod delete
- Remove hx-boost from <body> (was corrupting multipart uploads)
|
|
|
|
|
|
|
|
|
