Skip to content

NiceTryBot 0.6.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Oct 03:37
v0.6.0
e149e5c

NiceTryBot 0.6.0

Security fixes (update soon):

  • Password reset and verification links are built on the panel's own host. X-Forwarded-Host is only believed from the edge, so nobody can make the panel email a link to a host of their choosing.
  • Origins must be on the public internet. The edge checks each connection's address and refuses private, loopback and link-local ones (a cloud's metadata service, the stack's other containers). If your origins really are on a private network, set NICETRY_ALLOW_PRIVATE_ORIGINS=true in .env and run nicetrybot apply.
  • An origin that points back at the edge (its own preview hostname, another site here) gets 508 straight away instead of looping until it times out.
  • Gym triggers, rules and tarpits judge the path the origin will see, so /index.php/login and /_q/../login no longer get past a routine on /login. Paths with . or .. segments get 400.
  • A gym pass only works on the site it was earned on, for the routines its visitor cleared, and stops working when it turns up from more networks than one person uses. Verdicts on the client's own TLS fingerprint still count.
  • The edge's certificate check (/caddy/ask) needs the edge token, and an Origins authorize URL can only be set by an installation administrator. A transfer imported by anyone else adds its sites unverified.
  • A pattern from the app that's too large to compile is skipped instead of stopping the edge.

New:

  • The nicetrybot command works from your laptop too (macOS or Linux, with curl and jq): nicetrybot remote add panel.example.com saves a panel with an API token, then nicetrybot domains, domains add, domains check, rules, gyms, tools and call run there. nicetrybot cli update updates the command itself.
  • API tokens can work on all of your teams: nicetrybot teams lists them and nicetrybot team use SLUG switches.
  • nicetrybot domains add leads with the origin secret header and how to lock your origin to it; domains check finds the ownership TXT record and verifies the domain, and prints a checklist with the next step.
  • Colors on a terminal: commands to run in cyan, successes green, warnings yellow, errors red (plain text for pipes, logs and NO_COLOR).
  • MCP: whoami and remove-domain tools, tokens for all teams, and get-origin-secret includes the origin URL.
Assets 7
Loading