Skip to content

ThetaPrime v0.35.18

Choose a tag to compare

View all tags
@dsharma01 dsharma01 released this 28 Aug 02:34
· 5 commits to main since this release
v0.35.18
c59f922

Download ThetaPrime-0.35.18-setup.exe

Added

  • India VIX ticker in the navbar, mirroring the existing Nifty ticker (/api/vix, Kite→Breeze→Dhan with NSE fallback, 3s cache, 5s poll).

Fixed

Adversarial bug hunt round — 10 findings (RCE, races, key/secret leaks, auth bypass).

  • Path traversal via Windows backslashes (not blocked by Flask's <name> converter) could reach arbitrary file execution on /run_strategy et al. (runner.py) and arbitrary file read/write on ~10 trade-state routes (app.py); closed.
  • manual_entry no longer trusts an unverified phantom position — now requires broker.positions() confirmation before saving, matching edit_trade_state's confirm_active pattern.
  • Legacy .py strategies (lib_v1_trade, Lib_v1_1_lot, niftyStrgl_AI2, nifty_strangle_live) gain the same .entrylock hardening the spec engine already had, closing a double-entry race on a double /run_strategy POST.
  • manual_entry/manual_exit/edit_trade_state/close_long_legs now take the same .closelock the automated close and square_off already honor, closing a race against an in-flight close.
  • Backup zip no longer bundles the data-at-rest encryption key material in plaintext (redacted, not excluded — credentials-in-backup stays documented/intentional); restore no longer clobbers a live .secrets.json with the redacted copy.
  • Dev-loopback auth bypass no longer trusts remote_addr when a forwarding header is present (a reverse proxy/tunnel on the same host used to make every request look like 127.0.0.1).
  • Open-redirect guard now strips tab/CR/LF before checking, matching browser behavior before navigating.
  • notifier.py no longer logs the Telegram bot token / webhook secret embedded in a requests exception's URL.
  • change-password / recovery-code-regenerate now share /login's brute-force lockout.

[0.35.17] — 2026-08-27

Fixed

  • /api/desktop_alerts is now exempt from the prod login gate.
  • Webhook notification config was missing its "Send Test" button; added.
  • "Close Long Legs" button label corrected to "@ EOD" (was stale "@ 15:20").
Assets 3
Loading