Proudlock
397c02611a
security: fix admin bootstrap race and KB article disclosure
Address two security findings from darkwing scan:
Finding 1 [High]: Unauthenticated admin bootstrap race
- Require SETUP_TOKEN header or loopback origin for POST /api/setup/create-admin
- Enforce 12-character minimum password for bootstrap admin
- Cross-check setup_complete setting to prevent re-arming
- Log token to container logs on first startup for operator retrieval
- Add flask seed show-setup-token CLI helper
- Add audit log entry when first admin is created
- Preserve existing flask seed admin workflow (uses loopback)
Finding 2 [Medium]: Unauthenticated KB article disclosure
- Gate POST /api/knowledgebase/<id>/click on kb.view permission
- Remove linkurl from response (caller already has it from GET)
- Apply _visible_articles() filter to respect retired applications
- Prevent anonymous link enumeration and counter manipulation
Recovery paths if token is lost:
1. docker logs shopdb-api | grep "Setup token"
2. docker exec shopdb-api flask seed show-setup-token
3. docker exec shopdb-api flask seed admin (unchanged, always works)
Zero breaking changes. CLI and existing workflows unaffected.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-09-07 03:37:22 -04:00
..
2026-08-26 13:31:13 -04:00
2026-09-03 17:14:53 -04:00
2026-09-06 21:23:42 -04:00
2026-09-03 17:14:53 -04:00
2026-09-06 21:23:42 -04:00
2026-09-03 17:14:53 -04:00
2026-09-03 17:14:53 -04:00
2026-09-07 03:37:22 -04:00
2026-09-06 18:53:11 -04:00
2026-09-06 18:53:11 -04:00
2026-09-03 17:14:53 -04:00
2026-09-03 17:14:53 -04:00
2026-09-03 17:14:53 -04:00
2026-09-06 18:39:12 -04:00
2026-09-03 17:14:53 -04:00
2026-09-03 17:14:53 -04:00
2026-09-03 17:14:53 -04:00
2026-09-03 17:14:53 -04:00
2026-07-14 07:58:51 -04:00