4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	62576f6fc6	Bind the app port deliberately and document the proxy deployment (closes #268) (closes #226)	2026-08-24 03:38:44 +02:00
clawbot	33e4fa4faa	Report handler panics through the logger and answer 500 (closes #187)	2026-08-18 08:33:12 +02:00
clawbot	76725cffc4	Read form fields from the POST body only (closes #160) ... r.FormValue falls back to the query string, so POST /source/{id}/targets?url=<secret> created a working target from a value carried on the request line — where proxy logs, browser history and Referer all record it. Every form read is now r.PostFormValue, including the login password and both password-change fields, which had the same defect in a more acute form. The Sentry leg needed more than the query string. sentryhttp attaches the whole request to the scope, and ApplyToEvent copies the teed body into Request.Data with no SendDefaultPII guard — so reading every field from the body only pointed every credential this change protects at the one field the first revision did not scrub. Body and query are now redacted, Cookies and Env cleared, and Headers reduced to an allowlist, because the SDK's own filter removes four names and would otherwise ship X-Csrf-Token and the shared secrets senders put on the receiver route. Also adds json:"-" to Target.Config, APIKey.Key and Setting.Value — TargetView is the masking barrier for the HTML path only, and the first handler to marshal a model would serialise a bearer token or the session encryption key. Independently reviewed three times. The second review found the Data leak and proved it with a scratch module; the third disproved the PR's own claim that BeforeSend gets no request, so the README now records that redacting unconditionally is a deliberate choice rather than a limitation — which is what makes #179 cheap to fix.	2026-08-18 02:04:09 +02:00
clawbot	d51cd0fd29	Enforce the body size limit before CSRF parses the form (closes #90) ... CSRF ran before MaxBodySize, so the CSRF middleware parsed the form body before any cap applied and an oversized request was read in full before being rejected. MaxBodySize is now the first middleware in all four route groups that parse forms, ahead of CSRF and RequireAuth. An oversize request therefore gets 413 without the handler running and without state changing, including the password-change route. Note the ordering trade: an unauthenticated client now receives 413 rather than an auth redirect on /user/{username}/password.	2026-08-11 14:37:38 +02:00