Skip to content

SimpleSync 0.3.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Sep 09:11
0.3.4
2165d25
This commit was signed with the committer’s verified signature.
claude Claude
SSH Key Fingerprint: 32dP45eSMmVSt/G/CGvcxl/P+MO3Nwj9xeTh/GSA2wc
Verified
Learn about vigilant mode.

Security hardening after a review:

  • Login throttling can no longer be bypassed: besides the per-address limit there is a per-account limit (30 failed attempts in 15 minutes from any address), and a forged X-Forwarded-For header is ignored.
  • Unknown names and wrong passwords take the same time; at most a few password checks run at once.
  • Failed logins are logged with the name and address.
  • The web admin sends a strict Content-Security-Policy (no inline scripts).
  • The plugin rejects server paths that would leave the vault, and warns before logging in over plain http:// outside the home network.
  • The plugin settings explain up front that connecting to a server vault with files replaces this vault's content (nothing is lost: local files go to Obsidian's trash).
Assets 5
Loading