2.5.3 — Button API hardening

Follow-up hardening to the 2.5.2 security release. Every change here is additive and opt-in — nothing breaks on upgrade.

Button API hardening

api.php is the one endpoint that runs commands without a login (the per-button hash is the credential), so it got three improvements:

• Off by default for new installs. config.example.php now ships button_api disabled — enable it when you actually want it. Existing installs are deliberately left alone (the defaults backfill still enables it) so live automations keep working after git pull. Pin button_api in your config.php to choose explicitly.
• Send the key as a header. Query strings get written to web-server access logs, browser history and Referer headers. The key can now travel in a header instead:

  curl -H 'X-GumCP-Key: <32-char-hash>' http://<your-pi-ip>/GumCP/api.php

  ?hash= still works for existing automations.
• Optional IP allow-list. Limit which addresses may call the API; anything else gets a 403 before the hash is examined, and the attempt is logged:

  $gumcp_api_allow_ips = ['192.168.1.50', '192.168.1.0/24'];  // empty = no restriction

  Matching uses the real peer address, so a spoofed X-Forwarded-For header cannot bypass it. Behind a reverse proxy, the allowed address is the proxy's.

Documentation

• New README section “Limiting what GumCP can run” — a worked /etc/sudoers.d/gumcp allow-list so the SSH user doesn't need blanket NOPASSWD: ALL, with an explicit note on what stops working (the free-text Actions box, arbitrary buttons, Docker control, the boot-file editor and the in-app updater).

Upgrading

cd /var/www/html/GumCP && sudo git pull origin master

No configuration changes required. If you haven't upgraded through 2.5.2 yet, read its notes first — it fixes an unauthenticated RCE and requires configuring a login.