mirror of
https://github.com/allaunthefox/Research-Stack.git
synced 2026-08-13 22:40:35 +00:00
3347ebca7a
- run_import_workflow.py, run_multi_import.py: replace hardcoded budget password with BUDGET_PASSWORD env-var (fail-fast if unset) - server.js /ingest: replace shell-interpolated exec() with execFile() so user-controlled title/body cannot inject shell commands - authentik-values.yaml: blank out bootstrap_password and bootstrap_token so they must be supplied at deploy time via --set or sealed-secret - cluster-dashboard main.py: restrict CORS from allow_origins=["*"] to env-configurable whitelist (default: dashboard.researchstack.info), methods to GET, headers to Authorization+Content-Type - neo4j_obsidian_connector_router.js (both copies): replace permissive prefix-only readOnly regex with a deny-list that blocks CREATE/MERGE/DELETE/DETACH/SET/REMOVE/DROP anywhere in the query, and route readOnly queries through session.readTransaction() Co-Authored-By: Allaun Silverfox <bigdataiscoming+9i37y6j2@protonmail.com> |
||
|---|---|---|
| .. | ||
| arr-stack.yaml | ||
| audiobookshelf-jellyfin.yaml | ||
| authentik-values.yaml | ||
| bazarr-navidrome.yaml | ||
| Caddyfile | ||
| ebook2audiobook.yaml | ||
| homarr-kavita.yaml | ||
| media-ns.yaml | ||
| metube-suggestarr-boxarr.yaml | ||
| porkbun.env | ||
| prowlarr.yaml | ||
| qbittorrent.yaml | ||
| romm.yaml | ||
| sonarr.yaml | ||
| trailbase-flaresolverr.yaml | ||
| uptime-kuma.yaml | ||
| vaultwarden.yaml | ||