lywsvip/server
1
0
Fork 0
mirror of https://github.com/gotify/server.git synced 2026-09-06 15:57:32 +08:00
Code Issues Packages Projects Releases Wiki Activity
924 Commits 21 Branches 71 Tags
bcrypt-errors
Commit Graph

26 Commits

Author SHA1 Message Date
Yumechi
75bc19c111 fix: remove panic() and relay password hashing errors to UI 2026-08-06 12:32:23 +08:00
Jannis Mattheis
d832b1a41d fix: prevent csrf for cookie requests 
Prevously, the token was passed as X-Gotify-Key by the UI, so there was
no csrf because no cookie was added by the browser to the request.

The cookie is saved by SameSite=strict, this provides some protection
against csrf. But an subdomain takeover could still allow for csrf. E.g.
evil.gotify.net could send authenticated requests to gotify.net.

This uses the go builtin cross origin protection, listed on the owasp
page: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#built-in-or-existing-csrf-implementations
 2026-07-17 14:09:48 +02:00
Jannis Mattheis
a8744482c6 fix: enforce elevated authentication 2026-04-19 19:24:18 +02:00
Jannis Mattheis
57878e0574 fix: make secure cookie configurable 2026-04-11 18:53:48 +02:00
Jannis Mattheis
387da44883 fix: read token from cookie 2026-04-11 18:53:48 +02:00
Jannis Mattheis
39357c67d9 fix: simplify authentication handling 2026-04-11 18:53:48 +02:00
饺子w (Yumechi)
496c166981 chore: Migrate github.com/jinzhu/gorm to gorm.io/gorm (#863) 
* chore: Migrate github.com/jinzhu/gorm to gorm.io/gorm

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* chore: drop singleton connection limit on sqlite3 backend

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* enhance: database logging

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* Revert "chore: drop singleton connection limit on sqlite3 backend"

This reverts commit b494a3bd1f.

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* typo

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* rename unique_index -> uniqueIndex

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* drop uniqueIndex on primary key

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* migrate fully to new gorm tag format

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* specify unique index name

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* remove pluginConf duplicate index

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

* disable auto migrate FK

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>

---------

Signed-off-by: eternal-flame-AD <yume@yumechi.jp>
 2025-10-29 22:23:10 +00:00
Jannis Mattheis
a2b2f856e0 test: don't run tests twice 2023-09-17 09:05:15 +02:00
mateuscelio
70e1fd1863 Add authorization bearer token auth method 2022-12-03 10:45:07 +01:00
Jannis Mattheis
59b2ed17a6 Update linter 2022-05-29 19:45:45 +02:00
pigpig
c172590b92 Add registration 
Can be enabled via the registration config flag. (disabled per default)

Fixes gotify/server#395

Co-authored-by: pigpig <pigpig@pig.pig>
Co-authored-by: Karmanyaah Malhotra <32671690+karmanyaahm@users.noreply.github.com>
Co-authored-by: Jannis Mattheis <contact@jmattheis.de>
 2021-08-04 19:39:43 +02:00
Jannis Mattheis
7b90b8a8f5 Use v2 in package path 2020-05-08 10:43:17 +02:00
eternal-flame-AD
e5b24f4c92 Add plugin feature 
Fixed database migration
Added a plugin system based on the go plugin package
 2019-02-09 12:52:01 +01:00
Jannis Mattheis
6e488e612b Remove mock & Use database util in authentication handler 2018-03-25 19:33:29 +02:00
Jannis Mattheis
9e49849039 Use mode in all tests 2018-03-18 17:29:15 +01:00
Jannis Mattheis
433a83823b Use *ByToken methods in auth 2018-03-11 17:58:44 +01:00
Jannis Mattheis
cda4127551 Make password strength configurable 2018-02-23 19:39:34 +01:00
Jannis Mattheis
a5acb20d0e Use custom header for authentication 2018-02-18 12:56:42 +01:00
Jannis Mattheis
1e7e1a71f7 Rename to gotify 2018-02-12 16:48:01 +01:00
Jannis Mattheis
08dbacd71b Adjust authentication to also send 403 2018-02-11 14:33:59 +01:00
Jannis Mattheis
082b054f4c Improve build time 
The bcrypt hashing is really slow with enabled race condition checker,
therefore we exlcude it.
 2018-02-11 12:09:12 +01:00
Jannis Mattheis
4e3d00ea98 Reorder imports 2018-02-08 19:52:58 +01:00
Jannis Mattheis
fadf989158 Rename auth.Database methods 2018-01-28 15:56:28 +01:00
Jannis Mattheis
6770e6b654 Enable golint and fix golint-errors like adding documentation 2018-01-28 15:56:28 +01:00
Jannis Mattheis
8a989dc29a Remove token and add app and client token & Adjust tests 2018-01-27 20:31:56 +01:00
Jannis Mattheis
662e1f4fb5 Add authentication middleware 2018-01-23 18:03:51 +01:00