test-go / test (push) Successful in 1m29s
test-web / test (push) Successful in 1m37s
release / Build + push container image (push) Canceled after 0s
release / Verify release artifacts (tag releases only) (push) Canceled after 0s
test-go / integration (push) Canceled after 2m45s
release / Build signed APK (releases and dev) (push) Canceled after 3m40s
buildResetURL used r.Host and r.TLS, so a forgot-password request with a forged Host emailed the victim a real reset token on a link to the attacker's server. Links now come only from network_settings.public_url (migration 0062), and no reset email is sent while it is empty; the response stays the same opaque 200 and the log says why. The address is set on a new "Public address" card under Admin → Integrations, which offers the page's own origin and warns while unset. PUT /api/admin/network-settings takes either field alone, so the proxy card and this one can't overwrite each other. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
44 lines
1.4 KiB
Go
44 lines
1.4 KiB
Go
// Code generated by sqlc. DO NOT EDIT.
|
|
// versions:
|
|
// sqlc v1.31.1
|
|
// source: network_settings.sql
|
|
|
|
package dbq
|
|
|
|
import (
|
|
"context"
|
|
)
|
|
|
|
const getNetworkSettings = `-- name: GetNetworkSettings :one
|
|
SELECT id, trusted_proxy_hops, public_url FROM network_settings WHERE id = true
|
|
`
|
|
|
|
func (q *Queries) GetNetworkSettings(ctx context.Context) (NetworkSetting, error) {
|
|
row := q.db.QueryRow(ctx, getNetworkSettings)
|
|
var i NetworkSetting
|
|
err := row.Scan(&i.ID, &i.TrustedProxyHops, &i.PublicUrl)
|
|
return i, err
|
|
}
|
|
|
|
const updatePublicURL = `-- name: UpdatePublicURL :one
|
|
UPDATE network_settings SET public_url = $1 WHERE id = true RETURNING id, trusted_proxy_hops, public_url
|
|
`
|
|
|
|
func (q *Queries) UpdatePublicURL(ctx context.Context, publicUrl string) (NetworkSetting, error) {
|
|
row := q.db.QueryRow(ctx, updatePublicURL, publicUrl)
|
|
var i NetworkSetting
|
|
err := row.Scan(&i.ID, &i.TrustedProxyHops, &i.PublicUrl)
|
|
return i, err
|
|
}
|
|
|
|
const updateTrustedProxyHops = `-- name: UpdateTrustedProxyHops :one
|
|
UPDATE network_settings SET trusted_proxy_hops = $1 WHERE id = true RETURNING id, trusted_proxy_hops, public_url
|
|
`
|
|
|
|
func (q *Queries) UpdateTrustedProxyHops(ctx context.Context, trustedProxyHops int32) (NetworkSetting, error) {
|
|
row := q.db.QueryRow(ctx, updateTrustedProxyHops, trustedProxyHops)
|
|
var i NetworkSetting
|
|
err := row.Scan(&i.ID, &i.TrustedProxyHops, &i.PublicUrl)
|
|
return i, err
|
|
}
|