| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
| |
- Config file editor at /instances/{id}/config (browse & edit config/ files)
- Host networking for Docker container (fixes WireGuard MTU DNS issues)
- Whitelist changes applied live via RCON instead of stopping the server
- Config edit handler detects which fields changed: whitelist → RCON,
other settings → restart container
- walk_dir simplified (removed unused root param)
- import_world uses if-let instead of never-looping while-let
- docker-compose.yml updated as reference template
|
| |
|
|
|
|
|
|
|
| |
- Add column to mods table (auto-migrated)
- Toggle endpoint: rename .jar ↔ .jar.disabled on disk, flip DB flag
- Batch toggle & delete with checkboxes + JS helper (fixes nested-form bug)
- Raw Vec<(String,String)> form deserialization fixes 'duplicate field' error
- Batch action bars at top and bottom of mod list
- Uploads default to enabled=1, rescan skips .jar.disabled files
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
CRITICAL:
- Instance name path traversal (AP-001): sanitize::sanitize_instance_name()
strips .., /, \, \0, spaces, special chars at all 12 join call sites
- Zip-slip protection in world import: starts_with() guard after enclosed_name()
HIGH:
- RCON command injection: validate_username() rejects non-MC usernames
across all 6 player action macros (whitelist, op, ban)
- Level-seed properties injection: sanitize_seed() strips \n \r = : \0
- CSRF protection: SameSite=Lax -> SameSite=Strict on session cookie
MEDIUM:
- Session TTL: server-side 24h expiry via strftime check in require_auth
- Rate limiting: in-memory 10-ip/5min sliding window on login
- Background task stale is_active: all queries use concrete WHERE id=?1
- Mod validation DoS: 500MB cap, 10k class scan limit, 10k CP entry cap
LOW:
- Logout auth guard: moved into protected route group + CurrentUser param
- Mod orphan race: DB insert before file write
- Backup orphan race: DB insert before ZIP creation
- Template fix: broken Askama == comparisons in edit.html
All fixes compile clean with zero warnings. 10 unit tests pass.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- New mod validation engine (src/mods.rs) with constant-pool class-file
scanning: detects server-side content (block, tileentity, command,
worldgen) vs client-only API (gui, renderer, forge/client)
- 7 client-only mods correctly detected (AppleSkin, CraftingTweaks,
Durability101, EnchantmentDescriptions, InventoryHUD, MouseTweaks,
TrashSlot); 51 server-capable; 1 unknown
- Routes + templating for mod upload (jar/zip), listing, delete, rescan
- Multipart upload with 500MB limit (bypasses axum's default 2MB)
- Per-instance mod summary card on edit page
- Whitelist toggle checkbox on edit page (persisted, drives ENABLE_WHITELIST)
- Dynamic Java image tag (java8/java17/java21) based on MC version
- Class scan is informational-only; rejection based on metadata side=CLIENT
- has_modpack flag cleanup on mod delete
- Remove hx-boost from <body> (was corrupting multipart uploads)
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
