clusev

Commit Graph

Author	SHA1	Message	Date
boban	0f57074e6f	chore(audit): full code sweep — fix open-redirect, drop dead code, clean docs Full-codebase audit + automatic cleanup (no behavioural change for users). Security - ServerSwitcher: post-switch redirect is now reduced to a SAME-ORIGIN relative path. Rejects off-host referers, non-http(s) schemes (javascript:/data:), different ports (https://host:444/x -> /x), and protocol-relative tricks (//host, /\host). Closes a Referer open-redirect (Codex P2). - EditCredential: a key passphrase is stored only for key auth, never for password auth. Removed dead code - FirewallService::status/allow/deny (+ orphaned clampPort) - Server::auditEvents(), SshCredential::scopeActive(), unused 'bell' icon Cleanups / improvements - Files list + editor use a dedicated 'file' icon (was the audit icon) - Import RuntimeException/Throwable instead of FQN; fix stale docblocks (FirewallService, HardeningService) and the Files delete comment - Quote base64 in the sudo command path (defensive, consistent) - Null-safe Auth::user()?->email in Settings; single domain() read in hasTls() Release - Bump 0.1.0 -> 0.1.1 + CHANGELOG entry Verified: Pint clean, Codex review clean (no actionable regressions), R12 browser check — 9 routes HTTP 200, 0 console errors, lazy pages loaded. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-13 12:54:26 +02:00
boban	f418ab35ab	feat(ux): real metrics+context, working file manager, settings redesign, EN routes Full feedback round — all browser-verified (R12: 7 routes 200, zero console errors) and functionally tested live against the target host. - Metrics are real AND honest: poller now stores cpu/mem/DISK/LOAD history (all four sparklines real, not synthetic); KPIs show absolute context (Memory "1,9 / 7,8 GB", Disk "13 / 80 GB", Load "4 Kerne"); tiles are status-coloured and Load is rated against core count (so "yellow" actually means load≈0.7-1.0× cores), not a fixed warning tint. - File manager is functional: Hochladen (Livewire upload -> SFTP put), Download (SFTP get -> streamed), and view/edit (new FileEditor modal: SFTP get, binary/ size guards, SFTP put on save + audit). File names + Bearbeiten open the editor. - Settings redesigned (/frontend-design): account identity header + section nav (Profil / Sicherheit) instead of flat stacked panels. - Routes are English (R13): /einstellungen -> /settings; rule added to rules.md + CLAUDE.md. Dummy data removed: the topbar "Flotte online / Uptime 42d" + dead bell button are gone, replaced by a real "<online>/<total> online" pill. New: app/Livewire/Modals/FileEditor + view; FleetService get/read/write/upload + Sftp putFromFile/size. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-13 00:32:05 +02:00

Author

SHA1

Message

Date

boban

0f57074e6f

chore(audit): full code sweep — fix open-redirect, drop dead code, clean docs

Full-codebase audit + automatic cleanup (no behavioural change for users).

Security
- ServerSwitcher: post-switch redirect is now reduced to a SAME-ORIGIN
  relative path. Rejects off-host referers, non-http(s) schemes
  (javascript:/data:), different ports (https://host:444/x -> /x), and
  protocol-relative tricks (//host, /\host). Closes a Referer open-redirect
  (Codex P2).
- EditCredential: a key passphrase is stored only for key auth, never for
  password auth.

Removed dead code
- FirewallService::status/allow/deny (+ orphaned clampPort)
- Server::auditEvents(), SshCredential::scopeActive(), unused 'bell' icon

Cleanups / improvements
- Files list + editor use a dedicated 'file' icon (was the audit icon)
- Import RuntimeException/Throwable instead of FQN; fix stale docblocks
  (FirewallService, HardeningService) and the Files delete comment
- Quote base64 in the sudo command path (defensive, consistent)
- Null-safe Auth::user()?->email in Settings; single domain() read in hasTls()

Release
- Bump 0.1.0 -> 0.1.1 + CHANGELOG entry

Verified: Pint clean, Codex review clean (no actionable regressions),
R12 browser check — 9 routes HTTP 200, 0 console errors, lazy pages loaded.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-13 12:54:26 +02:00

boban

f418ab35ab

feat(ux): real metrics+context, working file manager, settings redesign, EN routes

Full feedback round — all browser-verified (R12: 7 routes 200, zero console errors)
and functionally tested live against the target host.

- Metrics are real AND honest: poller now stores cpu/mem/DISK/LOAD history (all
  four sparklines real, not synthetic); KPIs show absolute context (Memory
  "1,9 / 7,8 GB", Disk "13 / 80 GB", Load "4 Kerne"); tiles are status-coloured
  and Load is rated against core count (so "yellow" actually means load≈0.7-1.0×
  cores), not a fixed warning tint.
- File manager is functional: Hochladen (Livewire upload -> SFTP put), Download
  (SFTP get -> streamed), and view/edit (new FileEditor modal: SFTP get, binary/
  size guards, SFTP put on save + audit). File names + Bearbeiten open the editor.
- Settings redesigned (/frontend-design): account identity header + section nav
  (Profil / Sicherheit) instead of flat stacked panels.
- Routes are English (R13): /einstellungen -> /settings; rule added to rules.md +
  CLAUDE.md. Dummy data removed: the topbar "Flotte online / Uptime 42d" + dead
  bell button are gone, replaced by a real "<online>/<total> online" pill.

New: app/Livewire/Modals/FileEditor + view; FleetService get/read/write/upload +
Sftp putFromFile/size.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-13 00:32:05 +02:00

2 Commits (4bfa367ccfb67e841f7b9c2a53200db3e99e16fa)