vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

P0: Validate configuration and guard dev_login

closed · opened by keenan 13d ago

keenan opened this 13d ago

Why

forge/config/config.go accepts dangerous combinations. dev_login only checks that http_addr is loopback. Behind a proxy that rewrites Host to 127.0.0.1, isLoopbackRequest can return true for a public request, signing everyone in as the development account.

Scope

Add Config.Validate() invoked at startup.
Validate public_url as a bare https://host[:port] with no userinfo/path/query when used for WebAuthn.
Validate pages_domain as a bare DNS suffix.
Refuse dev_login when public_url or https_addr is set; require an explicit dev-only opt-in.
Require HTTPS public_url when open_registration is enabled.
Validate sizes, lease, page settings, ACME directory URL, and open_registration_role.
Fail startup on unsafe combinations; warnings are not enough.

Acceptance

A config with dev_login plus a public URL or HTTPS listener does not start.
A proxy-style Host: 127.0.0.1 cannot create a dev session.

Comments (1)

keenan 13d ago

Upgrade note found by actually upgrading a local instance: a config with dev_login and no dev_only now refuses to start (as designed), and the first version of the error did not say which file to edit — it arrives through a systemd journal, so “invalid configuration” alone leaves the operator guessing.

Both are fixed on the change request closing this issue: server.New prefixes the config path (or “built-in defaults”), and the dev_login refusal names the line to add. docs/configuration.md now says that a config predating dev_only has to add it, so the upgrade reads as one refused start rather than a browser that silently stops signing in.