MHSanaei 2e14a2a51a fix(web): refuse oversized login usernames before recording them ...

A failed login keeps its username in the in-memory log buffer, the
limiter table and the notifier queue, and the route accepted any body
the global cap allowed. The login route now takes at most 16 KiB and
answers a username over 256 bytes with the generic failure before any
of those see it; the user setters refuse such a name too, so no stored
username can be one the login route turns away.

2026-10-31 09:04:27 +00:00

..

api_token_scope_test.go

fix(auth): add node-admin token scope for panel updates (#6666)

2026-10-17 23:45:26 +02:00

api_token_test.go

perf(auth): look up api tokens by their hash index (#6915)

2026-10-24 05:06:49 +02:00

api_token.go

perf(auth): look up api tokens by their hash index (#6915)

2026-10-24 05:06:49 +02:00

panel_other.go

fix: make all self-managed file downloads/installs atomic, with real completion status (#5711)

2026-07-02 18:19:33 +02:00

panel_test.go

refactor(util): move panel version comparison into a shared package

2026-10-02 23:56:52 +02:00

panel_unix.go

fix: make all self-managed file downloads/installs atomic, with real completion status (#5711)

2026-07-02 18:19:33 +02:00

panel.go

refactor(util): move panel version comparison into a shared package

2026-10-02 23:56:52 +02:00

sponsor_test.go

feat(sponsors): drop the sidebar slot and simplify the Sponsors page

2026-10-13 23:32:56 +02:00

sponsor.go

fix(sponsor): fetch sponsor data from raw.githubusercontent.com

2026-10-14 17:10:02 +02:00

user_test.go

fix(web): refuse oversized login usernames before recording them

2026-10-31 09:04:27 +00:00

user.go

fix(web): refuse oversized login usernames before recording them

2026-10-31 09:04:27 +00:00

websocket.go

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00