46e0ffd
This commit was signed with the committer’s verified signature.
ericwang401
Eric Wang
Security
- Fixed the client API resolving
{iso}on its own rather than through the server it is nested under, which let a mount
request name an ISO belonging to a node the caller has no server on. No practical exposure followed from it: an ISO is
addressed by UUID, and the only place Convoy shows a non-administrator an ISO's UUID is the media list for a server on
that ISO's own node, where mounting it is already allowed. Hidden ISOs were refused either way. The fix restores the
scoped route-model binding that the rest of the client API relies on to keep one server's URL from reaching another
server's resources.
Fixed
- Fixed servers with no bandwidth limit being incorrectly rate limited to 1 MB/s (#157).
SHA256 Checksum
129d6b9e3e54a8514d3e7b0ca88dd9f4d5e7584dc3a466337c090c8e646e8825 panel.tar.gz