Skip to content

V1.3.3.0 - security and reliability audit tranche

Choose a tag to compare

View all tags
@SpiritFramework SpiritFramework released this 09 Sep 19:49
· 106 commits to main since this release
V1.3.3.0
1cc8340

Summary

Security and reliability tranche from the Spirit-Panel audit, plus UX hardening.

Security

  • Application API sanitizes server/owner responses (no Wings daemon tokens / password hashes / TOTP / PATs)
  • Cannot disable/reset/delete elevated accounts via Application API
  • DNS-resolved SSRF checks for DB + SMTP hosts
  • SQL guard blocks OUTFILE / LOAD_FILE / LOAD DATA
  • Staff node JSON no longer includes daemonTokenId

Reliability

  • Atomic allocation claims + in-transaction capacity checks
  • Safer Wings-aware server delete
  • Schedule run locking via lastRunAt claim
  • Zip/tarball updates preserve panel-api and packages dist

UX / ops

  • Settings load error + retry; post-login deep links; console command errors; PWA reload banner
  • nginx security headers on cached locations; featherwings docs/binary alignment; Redis systemd ordering
  • Installer SCRIPT_VERSION 2.0.5

Update

curl -fsSL https://raw.githubusercontent.com/SpiritFramework/SpiritPanel/main/scripts/spirit.sh -o /tmp/spirit.sh
sudo bash /tmp/spirit.sh update -y
Assets 3
Loading