clawbot 7d360babed Logging in returns to the page that was asked for (closes #384) ...

A logged-out GET of an admin page now redirects to /pages/login with its path and query in a next parameter, when they fit in 2048 bytes. The login form carries next as a hidden field; a successful login redirects there, and a failed one shows the page again with the same next. A POST still redirects to plain /pages/login.

The value is client-chosen, so every read of it goes through one check: after percent-decoding it must start with exactly one / and contain no backslash or control character; anything else becomes /. gosec's open-redirect rule is suppressed on the two redirects that follow it. The login page's navigation bar no longer links to itself.

Model: opus-5-5

2026-10-02 06:57:51 +02:00

..

accesslog_test.go

Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367)

2026-10-02 06:32:14 +02:00

csrf_test.go

Default WEBHOOKER_ENVIRONMENT to prod (closes #307)

2026-09-28 12:47:31 +02:00

csrf.go

Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367)

2026-10-02 06:32:14 +02:00

export_test.go

Derive cookie Secure and CSRF strictness from the request transport (closes #269)

2026-08-24 03:01:37 +02:00

logbound_test.go

Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367)

2026-10-02 06:32:14 +02:00

loginguard_test.go

Stop a slow host turning a login-guard test into a segfault (closes #186)

2026-08-18 05:01:13 +02:00

loginguard.go

Trust the RFC 1918 ranges as proxies when TRUSTED_PROXIES is unset (closes #333)

2026-10-02 00:41:36 +02:00

metrics_method_test.go

Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367)

2026-10-02 06:32:14 +02:00

metrics_test.go

Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367)

2026-10-02 06:32:14 +02:00

metrics.go

Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367)

2026-10-02 06:32:14 +02:00

middleware_test.go

Logging in returns to the page that was asked for (closes #384)

2026-10-02 06:57:51 +02:00

middleware.go

Logging in returns to the page that was asked for (closes #384)

2026-10-02 06:57:51 +02:00

ratelimit_test.go

Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367)

2026-10-02 06:32:14 +02:00

ratelimit.go

Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367)

2026-10-02 06:32:14 +02:00

recoverer_test.go

Drop Set-Cookie from the recovered 500 (closes #193)

2026-09-29 10:30:26 +02:00

recoverer.go

Drop Set-Cookie from the recovered 500 (closes #193)

2026-09-29 10:30:26 +02:00

testing.go

refactor: use pinned golangci-lint Docker image for linting (#55)

2026-03-25 02:16:38 +01:00