MHSanaei dcaadd4857 fix(panel): validate sponsor logo name before any file or network use ...

The public /sponsors/logo/:name route only accepted names matching an
active sponsor's logo, which was already regex-filtered, but that guard
was indirect. Checking sponsorLogoRe on the name itself makes the
path/URL safety local and clears CodeQL alerts #113 (go/request-forgery)
and #114 (go/path-injection).

2026-09-26 12:40:31 +02:00

..

api_token_scope_test.go

feat(api): scoped, optionally expiring API tokens (#6201)

2026-08-15 15:31:49 +02:00

api_token_test.go

fix(cli): let -getApiToken name the token it regenerates (#6405)

2026-09-08 14:15:37 +02:00

api_token.go

fix(cli): let -getApiToken name the token it regenerates (#6405)

2026-09-08 14:15:37 +02:00

panel_other.go

fix: make all self-managed file downloads/installs atomic, with real completion status (#5711)

2026-07-02 18:19:33 +02:00

panel_test.go

fix(panel): forward the panel's proxy to update.sh's own downloads (#6259)

2026-08-24 03:01:56 +02:00

panel_unix.go

fix: make all self-managed file downloads/installs atomic, with real completion status (#5711)

2026-07-02 18:19:33 +02:00

panel.go

fix(panel): forward the panel's proxy to update.sh's own downloads (#6259)

2026-08-24 03:01:56 +02:00

sponsor_test.go

feat(panel): add sponsor slots fed from sponsors.sanaei.dev

2026-09-26 03:31:51 +02:00

sponsor.go

fix(panel): validate sponsor logo name before any file or network use

2026-09-26 12:40:31 +02:00

user.go

fix(panel): accept 2FA codes from adjacent TOTP windows (#6546)

2026-09-15 15:42:30 +03:00

websocket.go

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00