Skip to content

V1.3.4.0 - audit leftovers (API, ConfirmModal, CSP)

Choose a tag to compare

View all tags
@SpiritFramework SpiritFramework released this 09 Sep 20:10
· 105 commits to main since this release
V1.3.4.0
9e60df5

Spirit Panel V1.3.4.0

Second audit tranche: API hardening, ConfirmModal leftovers, full nginx CSP sync, UI a11y polish.

Security

  • Application API keys with permissions: null / empty scopes are denied
  • Password reset tokens stored hashed (SHA-256)
  • Secret encryption v2 (per-secret salt); legacy still decrypts
  • Login lockout by identity alone
  • Production rate-limit store errors fail closed

Fixed

  • Wings /servers/reset no longer marks mid-install servers installed
  • Browser probe hits /api/system (quieter DevTools)
  • nginx CSP sync compares the full CSP add_header line
  • Settings dirty leave + remaining confirm() → ConfirmModal

Changed

  • Version compare in @spirit/shared; installer SCRIPT_VERSION 2.0.6

Update

curl -fsSL https://raw.githubusercontent.com/SpiritFramework/SpiritPanel/main/scripts/spirit.sh -o /tmp/spirit.sh
sudo bash /tmp/spirit.sh update -y
Assets 3
Loading