Skip to content

v2026-03-08.2 — Security Hardening & Dependency Audit

Choose a tag to compare

View all tags
@itsDNNS itsDNNS released this 08 Mar 10:01
· 900 commits to main since this release
v2026-03-08.2
4e66a93

Security

  • Reverse proxy hardening (#160): _get_client_ip() no longer blindly trusts X-Forwarded-For headers, preventing rate limit bypass via IP spoofing. Set REVERSE_PROXY=1 env var to enable Werkzeug ProxyFix for trusted proxy setups. SESSION_COOKIE_SECURE is auto-enabled in proxy mode.
  • SSRF URL validation (#160): Config URL keys (modem_url, bqm_url, etc.) reject non-HTTP schemes (file://, gopher://, etc.). Theme registry downloads are restricted to trusted GitHub domains only.
  • DOM XSS escaping (#160): All innerHTML assignments rendering server-sourced data now use escapeHtml() across BNetzA, correlation, speedtest, BQM, and channel compare views.
  • Module isolation (#160): Community modules no longer receive decrypted secrets (modem_password, admin_password, etc.) unless explicitly declared in their manifest. Route conflict detection blocks community modules from shadowing core endpoints (/login, /api/config, etc.).

Dependencies (#161)

  • All Python packages bumped to latest stable: cryptography 42→46, pypdf 4→6, flask 3.0→3.1, beautifulsoup4 4.12→4.14, and others
  • GitHub Actions updated: checkout v6, setup-python v6, docker actions v4-v7
  • Lucide Icons 0.575.0 → 0.577.0

Bug Fixes

  • SURFboard S34 (#165): Fix HNAP data requests using GetMoto*/GetCustomer* variants
  • CM8200A (#172): Fix TLS handshake and authentication flow
  • Signal Trends X-axis: Labels now display 6 evenly spaced horizontal timestamps instead of overlapping rotated text
Assets 2
Loading