Louis King 4b58160f31 fix: harden security across auth, XSS, and proxy trust ...

- Use hmac.compare_digest for constant-time API key comparison in auth
  and metrics endpoints to prevent timing attacks
- Escape user-controlled data in admin JS templates (members, node-tags)
  to prevent XSS via innerHTML
- Escape </script> sequences in embedded JSON config to prevent XSS
  breakout from <script> blocks
- Add configurable WEB_TRUSTED_PROXY_HOSTS setting instead of trusting
  all proxy headers unconditionally
- Warn on startup when admin is enabled with default trust-all proxy
- Remove legacy HTML dashboard endpoint (unused, superseded by SPA)
- Add comprehensive auth and dashboard test coverage

2026-03-09 22:53:53 +00:00

..

__init__.py

Implement Phase 1: Foundation for MeshCore Hub

2025-12-02 23:10:53 +00:00

conftest.py

Add feature flags to control web dashboard page visibility

2026-02-10 15:43:23 +00:00

test_admin.py

Add LetsMesh compatibility ingest, decoder integration, and admin auth updates

2026-03-03 16:18:54 -05:00

test_advertisements.py

Rewrite web dashboard as Single Page Application

2026-02-10 00:23:45 +00:00

test_app.py

fix: harden security across auth, XSS, and proxy trust

2026-03-09 22:53:53 +00:00

test_caching.py

Add HTTP caching for web dashboard resources

2026-02-14 00:01:08 +00:00

test_dashboard.py

Rename /network to /dashboard and add reusable icon macros

2026-02-06 22:53:36 +00:00

test_features.py

Add feature flags to control web dashboard page visibility

2026-02-10 15:43:23 +00:00

test_health.py

Added more test coverage

2026-01-12 20:34:53 +00:00

test_home.py

Rewrite web dashboard as Single Page Application

2026-02-10 00:23:45 +00:00

test_map.py

Enhance map page with GPS fallback, infrastructure filter, and UI improvements

2026-02-07 20:05:56 +00:00

test_members.py

Rewrite web dashboard as Single Page Application

2026-02-10 00:23:45 +00:00

test_messages.py

Add LetsMesh compatibility ingest, decoder integration, and admin auth updates

2026-03-03 16:18:54 -05:00

test_nodes.py

Rewrite web dashboard as Single Page Application

2026-02-10 00:23:45 +00:00

test_pages.py

Rewrite web dashboard as Single Page Application

2026-02-10 00:23:45 +00:00