From 4ca2ed96d53f1d66c9d6128092449f90ce2321f8 Mon Sep 17 00:00:00 2001 From: boban Date: Mon, 22 Jun 2026 06:19:46 +0200 Subject: [PATCH] feat(brand): source-view comment + console branding with self-XSS warning (v0.9.56) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - A friendly HTML comment in the page source (both layouts, before ) — ASCII "CLUSEV", what it is, and the project link — for anyone who View-Sources. - A styled console banner printed on load (every page, incl. login): the CLUSEV wordmark, a one-liner, the repo link, AND a self-XSS security warning. The warning earns its place: a Linux-server control panel is a prime target for "paste this into your console" social engineering, so the notice sits exactly where that attack happens. console styling is best-effort and never throws. Verified: /login 200, the console logs the brand + warning + link, the source carries the comment, no page errors; 374 tests pass; Vite build clean. Co-Authored-By: Claude Opus 4.8 --- CHANGELOG.md | 10 ++++++++- config/clusev.php | 2 +- resources/js/app.js | 21 +++++++++++++++++++ .../views/components/source-comment.blade.php | 21 +++++++++++++++++++ resources/views/layouts/app.blade.php | 1 + resources/views/layouts/auth.blade.php | 1 + 6 files changed, 54 insertions(+), 2 deletions(-) create mode 100644 resources/views/components/source-comment.blade.php diff --git a/CHANGELOG.md b/CHANGELOG.md index 6256565..52d0541 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,7 +13,15 @@ getaggte Releases (Kanal `stable`, optional `beta`) — niemals Entwicklungs-Bui _Keine offenen Änderungen — der nächste Stand wird hier gesammelt und als `vX.Y.Z` getaggt._ -## [0.9.55] - 2026-06-22 +## [0.9.56] - 2026-06-22 + +### Hinzugefügt +- **Branding im Quelltext + in der Browser-Konsole.** Wer den Seitenquelltext ansieht, findet jetzt + einen freundlichen Clusev-Hinweis (wer wir sind, Projektlink) als HTML-Kommentar. Öffnet jemand die + Browser-Konsole, erscheint ein gestyltes „CLUSEV"-Branding mit Projektlink — **und eine + Self-XSS-Sicherheitswarnung**: bei einem Server-Control-Panel ist „Füg das mal in deine Konsole ein" + ein realer Social-Engineering-Angriff, daher der Hinweis genau dort. Erscheint auf jeder Seite (auch + vor dem Login). ### Behoben - **Datei-Manager: Dateiname im Tablet-Modus vom Rechte-Block überdeckt.** Die Tabellenspalten diff --git a/config/clusev.php b/config/clusev.php index fd36c99..97432f3 100644 --- a/config/clusev.php +++ b/config/clusev.php @@ -2,7 +2,7 @@ return [ // First tagged release is v0.1.0 (semantic, not -dev). - 'version' => '0.9.55', + 'version' => '0.9.56', // Deployed commit + branch. install.sh bakes these into .env from the host's .git (the prod // image ships no .git); the Versions page prefers them and falls back to a live .git read in diff --git a/resources/js/app.js b/resources/js/app.js index 1a4f8ce..66fd3d4 100644 --- a/resources/js/app.js +++ b/resources/js/app.js @@ -387,3 +387,24 @@ document.addEventListener('alpine:init', () => { }, })); }); + +// ── Console branding + self-XSS warning ───────────────────────────────────────────────────────── +// Printed once on load. The security notice is not decoration: a control panel for Linux servers is +// a prime target for "paste this in your console" social-engineering (self-XSS) — surfacing the +// warning where the attack happens protects admins. Styling is best-effort; never throws. +(() => { + try { + const big = 'color:#FF6B2C;font:800 44px/1.1 "JetBrains Mono",ui-monospace,monospace;text-shadow:0 0 14px rgba(255,107,44,.45);padding:6px 0'; + const sub = 'color:#9DAAB6;font:13px ui-monospace,monospace'; + const warnH = 'color:#FF5247;font:700 15px ui-monospace,monospace'; + const warnB = 'color:#E8B931;font:12px/1.5 ui-monospace,monospace'; + const link = 'color:#43C1D8;font:12px ui-monospace,monospace'; + console.log('%cCLUSEV', big); + console.log('%cSelf-hosted control plane für deine Linux-Flotte.', sub); + console.log('%c⚠ Stopp — diese Konsole ist für Entwickler.', warnH); + console.log('%cFüg hier NICHTS ein, das dir jemand geschickt hat. Solche „Tricks" sind fast\nimmer Betrug (Self-XSS) und können deine Sitzung und deine Server übernehmen.', warnB); + console.log('%cNeugierig? Fragen? Mitbauen? → https://git.bave.dev/boban/clusev · AGPL-3.0', link); + } catch (_) { + // console styling unsupported — ignore + } +})(); diff --git a/resources/views/components/source-comment.blade.php b/resources/views/components/source-comment.blade.php new file mode 100644 index 0000000..3840cdf --- /dev/null +++ b/resources/views/components/source-comment.blade.php @@ -0,0 +1,21 @@ +{{-- Source-view easter egg + a friendly hello. Rendered as a real HTML comment (passed through to + the page source), so anyone who "View Source" sees who built this and how to reach us. --}} + diff --git a/resources/views/layouts/app.blade.php b/resources/views/layouts/app.blade.php index 3d9143c..7a88119 100644 --- a/resources/views/layouts/app.blade.php +++ b/resources/views/layouts/app.blade.php @@ -1,5 +1,6 @@ + @inject('deployment', 'App\Services\DeploymentService') @php // Reverb (Echo) endpoint derived at RUNTIME from the effective domain, so changing diff --git a/resources/views/layouts/auth.blade.php b/resources/views/layouts/auth.blade.php index 9690b2d..a12f3a2 100644 --- a/resources/views/layouts/auth.blade.php +++ b/resources/views/layouts/auth.blade.php @@ -1,5 +1,6 @@ +