feat(brand): source-view comment + console branding with self-XSS warning (v0.9.56)
- A friendly HTML comment in the page source (both layouts, before <head>) — ASCII "CLUSEV", what it is, and the project link — for anyone who View-Sources. - A styled console banner printed on load (every page, incl. login): the CLUSEV wordmark, a one-liner, the repo link, AND a self-XSS security warning. The warning earns its place: a Linux-server control panel is a prime target for "paste this into your console" social engineering, so the notice sits exactly where that attack happens. console styling is best-effort and never throws. Verified: /login 200, the console logs the brand + warning + link, the source carries the comment, no page errors; 374 tests pass; Vite build clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>feat/v1-foundation v0.9.56
boban
parent
8914f5f746
commit
4ca2ed96d5
10
CHANGELOG.md
10
CHANGELOG.md
|
|
@ -13,7 +13,15 @@ getaggte Releases (Kanal `stable`, optional `beta`) — niemals Entwicklungs-Bui
|
|||
|
||||
_Keine offenen Änderungen — der nächste Stand wird hier gesammelt und als `vX.Y.Z` getaggt._
|
||||
|
||||
## [0.9.55] - 2026-06-22
|
||||
## [0.9.56] - 2026-06-22
|
||||
|
||||
### Hinzugefügt
|
||||
- **Branding im Quelltext + in der Browser-Konsole.** Wer den Seitenquelltext ansieht, findet jetzt
|
||||
einen freundlichen Clusev-Hinweis (wer wir sind, Projektlink) als HTML-Kommentar. Öffnet jemand die
|
||||
Browser-Konsole, erscheint ein gestyltes „CLUSEV"-Branding mit Projektlink — **und eine
|
||||
Self-XSS-Sicherheitswarnung**: bei einem Server-Control-Panel ist „Füg das mal in deine Konsole ein"
|
||||
ein realer Social-Engineering-Angriff, daher der Hinweis genau dort. Erscheint auf jeder Seite (auch
|
||||
vor dem Login).
|
||||
|
||||
### Behoben
|
||||
- **Datei-Manager: Dateiname im Tablet-Modus vom Rechte-Block überdeckt.** Die Tabellenspalten
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
return [
|
||||
// First tagged release is v0.1.0 (semantic, not -dev).
|
||||
'version' => '0.9.55',
|
||||
'version' => '0.9.56',
|
||||
|
||||
// Deployed commit + branch. install.sh bakes these into .env from the host's .git (the prod
|
||||
// image ships no .git); the Versions page prefers them and falls back to a live .git read in
|
||||
|
|
|
|||
|
|
@ -387,3 +387,24 @@ document.addEventListener('alpine:init', () => {
|
|||
},
|
||||
}));
|
||||
});
|
||||
|
||||
// ── Console branding + self-XSS warning ─────────────────────────────────────────────────────────
|
||||
// Printed once on load. The security notice is not decoration: a control panel for Linux servers is
|
||||
// a prime target for "paste this in your console" social-engineering (self-XSS) — surfacing the
|
||||
// warning where the attack happens protects admins. Styling is best-effort; never throws.
|
||||
(() => {
|
||||
try {
|
||||
const big = 'color:#FF6B2C;font:800 44px/1.1 "JetBrains Mono",ui-monospace,monospace;text-shadow:0 0 14px rgba(255,107,44,.45);padding:6px 0';
|
||||
const sub = 'color:#9DAAB6;font:13px ui-monospace,monospace';
|
||||
const warnH = 'color:#FF5247;font:700 15px ui-monospace,monospace';
|
||||
const warnB = 'color:#E8B931;font:12px/1.5 ui-monospace,monospace';
|
||||
const link = 'color:#43C1D8;font:12px ui-monospace,monospace';
|
||||
console.log('%cCLUSEV', big);
|
||||
console.log('%cSelf-hosted control plane für deine Linux-Flotte.', sub);
|
||||
console.log('%c⚠ Stopp — diese Konsole ist für Entwickler.', warnH);
|
||||
console.log('%cFüg hier NICHTS ein, das dir jemand geschickt hat. Solche „Tricks" sind fast\nimmer Betrug (Self-XSS) und können deine Sitzung und deine Server übernehmen.', warnB);
|
||||
console.log('%cNeugierig? Fragen? Mitbauen? → https://git.bave.dev/boban/clusev · AGPL-3.0', link);
|
||||
} catch (_) {
|
||||
// console styling unsupported — ignore
|
||||
}
|
||||
})();
|
||||
|
|
|
|||
|
|
@ -0,0 +1,21 @@
|
|||
{{-- Source-view easter egg + a friendly hello. Rendered as a real HTML comment (passed through to
|
||||
the page source), so anyone who "View Source" sees who built this and how to reach us. --}}
|
||||
<!--
|
||||
|
||||
____ _
|
||||
/ ___| |_ _ ___ _____ __
|
||||
| | | | | | / __|/ _ \ \ / /
|
||||
| |___| | |_| \__ \ __/\ V /
|
||||
\____|_|\__,_|___/\___| \_/
|
||||
|
||||
Clusev — self-hosted control plane for a fleet of Linux servers.
|
||||
Agentless over SSH · security-first · open core (AGPL-3.0).
|
||||
|
||||
Du liest den Quelltext — schön! Neugierig, wie das gebaut ist?
|
||||
Fragen, Feedback oder mitbauen? Wir freuen uns:
|
||||
→ https://git.bave.dev/boban/clusev
|
||||
|
||||
PS: Konsole & Quelltext sind für Entwickler. Füg hier NICHTS ein, das dir
|
||||
jemand geschickt hat — solche „Tricks" sind fast immer Betrug (Self-XSS).
|
||||
|
||||
-->
|
||||
|
|
@ -1,5 +1,6 @@
|
|||
<!DOCTYPE html>
|
||||
<html lang="{{ app()->getLocale() }}">
|
||||
<x-source-comment />
|
||||
@inject('deployment', 'App\Services\DeploymentService')
|
||||
@php
|
||||
// Reverb (Echo) endpoint derived at RUNTIME from the effective domain, so changing
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
<!DOCTYPE html>
|
||||
<html lang="{{ app()->getLocale() }}">
|
||||
<x-source-comment />
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
|
|
|
|||
Loading…
Reference in New Issue