Xiangzhe 60060a6dca fix(security): mask the Obsidian WebDAV password from non-management callers ...

GET /api/settings/obsidian/webdav returned the plaintext webdavPassword to any
caller the handler admitted — including an anonymous caller reaching it through
the requireLogin=false open mode (the default management pipeline already blocks
non-manage keys). The plaintext is now returned only to a genuine management
principal (dashboard session or manage-scope key); everyone else gets a
`webdavPasswordSet` flag instead. The dashboard's authenticated reveal view is
unchanged.

Reported by @0raN9ewww via GHSA-62vw-4m6w-cqqq (and the credential-exposure
portion of GHSA-p855-p6fm-76r3).

2026-08-21 14:49:30 -03:00

..

app

fix(security): mask the Obsidian WebDAV password from non-management callers

2026-08-21 14:49:30 -03:00

domain

fix(domain): treat unreported Antigravity quota fraction as unknown, not exhausted (#10095)

2026-08-20 20:29:38 -03:00

hooks

fix(dashboard): send periodic WS heartbeat pings to stop live-dashboard reconnect churn (#10452)

2026-08-18 10:50:26 -03:00

i18n

feat(search): first-class X Search via SuperGrok x_search (#10988)

2026-08-21 14:16:42 -03:00

lib

feat(search): first-class X Search via SuperGrok x_search (#10988)

2026-08-21 14:16:42 -03:00

middleware

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

mitm

fix(agent-bridge): make the regenerate-cert endpoint actually mint a new cert (#10467) (#10715)

2026-08-20 06:28:41 -03:00

models

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

scripts

feat(db): consolidate all database settings into SystemStorageTab (closes #1935) (#1947)

2026-05-04 19:25:41 -03:00

server

fix(security): close 4 STILL-REAL advisory findings (ACP RCE hardening, db-backups tier, uppercase authz bypass, spawn-veto drift) (#11028)

2026-08-21 13:57:42 -03:00

shared

fix(security): enforce per-key policy for a bare x-api-key (allowedModels bypass)

2026-08-21 14:49:30 -03:00

sse

feat(search): first-class X Search via SuperGrok x_search (#10988)

2026-08-21 14:16:42 -03:00

store

Release v3.8.38 (#5078)

2026-06-27 09:07:12 -03:00

types

maint: follow-up cherry-pick fix-in-place #9510 (fallback resolution) (#9880)

2026-08-09 10:07:10 -03:00

instrumentation-node.ts

fix(startup): log when credential health check is disabled (#11016) (#11021)

2026-08-21 14:00:27 -03:00

instrumentation.ts

fix(cli): guarantee non-empty [STARTUP] Fatal log on instrumentation-hook boot throw (#10447)

2026-08-18 10:57:44 -03:00

proxy.ts

fix(security): close 4 STILL-REAL advisory findings (ACP RCE hardening, db-backups tier, uppercase authz bypass, spawn-veto drift) (#11028)

2026-08-21 13:57:42 -03:00