Skip to content

🚪 DoorOpener v1.13.0

Choose a tag to compare

View all tags
@Sloth-on-meth Sloth-on-meth released this 09 Apr 09:43
· 28 commits to main since this release
v1.13
8fa80e1

🔐 Security

  • Fix: CSRF token missing for OIDC admin logins — admins authenticating via SSO were never issued an admin_csrf_token, causing all CSRF-protected admin endpoints to be broken or bypassable for SSO users
  • Admin dashboard HTML now gated server-side — the full admin UI (forms, JS, API endpoint names) is only rendered when the session is authenticated; unauthenticated requests receive the login form only
  • Fix: unauthenticated GET /admin/background — endpoint now requires admin auth
  • IP-based rate limiting on /admin/auth — the previous session-only limit could be bypassed by opening multiple browser sessions; failures now increment a per-IP counter so multi-session brute force is blocked
  • Replaced imghdr with filetype — imghdr was removed from the Python stdlib in 3.13 and was unmaintained; filetype uses proper magic-byte detection
  • Removed obsolete X-XSS-Protection header — a no-op in all modern browsers and superseded by CSP
  • test_mode and FLASK_DEBUG warnings — both now log a prominent warning at startup (and test_mode shows a banner in the admin panel) to prevent accidental production deployments with unsafe settings

✨ New Features

  • Public notice — post a short message from the admin panel that appears as a banner above the keypad (e.g. "Door out of service until Monday")
  • Custom background image — upload a JPEG/PNG/GIF/WebP background from the admin panel (max 10 MB); the original default is preserved and can be restored at any time
  • Pushbullet problem reporting — set [pushbullet] api_token in config.ini to enable a report button on the keypad; users can send messages directly to you, rate-limited to 3 per IP per hour
  • Optional page title — set [server] page_title to display a site name above the keypad

🎨 UI/UX

  • Terminal-style "ACCESS GRANTED" animation on successful door open
  • Access denied popup with scan line animation
  • Page-bounce animation on Easter egg activation
  • Toast notifications for door access errors
  • Gear icon navigation button and GitHub link in the admin panel
  • Admin panel layout refactored for better responsiveness

📦 Dependencies

  • requests 2.32.5 → 2.33.0
  • authlib 1.6.7 → 1.6.9
  • filetype 1.2.0 added (replaces imghdr)
  • Docker base image updated to Python 3.12

Full changelog: CHANGELOG.md

Assets 2
Loading