Skip to content

Windlass v0.57

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Oct 16:56
· 10 commits to main since this release
v0.57
009c662

Personal API tokens, viewer masking and a set of security fixes.

  • API tokens. Create them in Settings and send them as a bearer token. Each has a scope and an optional expiry, and admins can revoke anyone's through the API. See the API guide.
  • Viewers no longer see secret values. .env values and values a Compose file sets inline are masked for the viewer role.
  • One instance per data directory. A second Windlass started on the same data directory now refuses to run (#43).
  • Cross-origin writes are refused, and the Git token no longer appears in process arguments.
  • Turning off two-factor asks for a current code.

Plugin SDK changes

Both affect plugins that use the panel's proxy.

  1. The proxy no longer forwards the session cookie or the Authorization header to the plugin.
  2. Anything other than GET, HEAD and OPTIONS, and any WebSocket upgrade, through the proxy now needs the member role.
Assets 6
Loading