mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-25 00:22:09 +03:00
e1fdfc40a5
GHSA-v7g9-7f55-5g46 (follow-up to mghq): /api/settings/export-json dumps every stored credential and /api/settings/import-json irreversibly replaces settings, yet both were left out of the mghq ALWAYS_PROTECTED fix and their handlers only gate on isAuthRequired() — false under requireLogin=false. Added to ALWAYS_PROTECTED_API_PATHS alongside /api/settings/database and /api/db-backups. GHSA-x7vm-hp44-9p79: the MITM management routes (/api/settings/mitm, /api/cli-tools/antigravity-mitm) install a system-wide trusted root CA and write /etc/hosts DNS overrides, but were MANAGEMENT-only — remotely reachable under requireLogin=false, violating the documented loopback contract for privileged surfaces (Hard Rules #15/#17). Added to LOCAL_ONLY_API_PREFIXES and SPAWN_CAPABLE_PREFIXES (never manage-scope bypassable), same tier as /api/tools/agent-bridge/.