Commit Graph
8 Commits
Author SHA1 Message Date
maziggy 3fa9ed2b91 Add authentication to 200+ API endpoints (CVE-2026-25505)
Security fix for critical vulnerability (CVSS 9.8) where API endpoints
were accessible without authentication when auth was enabled.

Changes:
- Add RequirePermissionIfAuthEnabled() to all unprotected route files:
  archives, projects, settings, api_keys, groups, cloud, github_backup,
  support, notifications, notification_templates, maintenance, filaments,
  external_links, smart_plugs, discovery, firmware, kprofiles, camera,
  ams_history, pending_uploads, updates, spoolman, system, print_queue,
  printers
- Keep image-serving endpoints (thumbnails, timelapse, photos, camera
  streams, icons) unauthenticated since <img> tags cannot send headers
- Add backend integration tests for endpoint auth enforcement
- Add frontend tests for ownership-based permissions (canModify)

Fixes: CVE-2026-25505
2026-02-03 08:44:07 +01:00
maziggy ea93535bfc Add TOTP authenticator support for Bambu Cloud login (fixes #182)
TOTP (Two-Factor Authentication):
- Detect TOTP vs email verification from Bambu API loginType response
- Use dedicated TFA endpoint on bambulab.com (not api.bambulab.com)
- Include browser-like headers to bypass Cloudflare protection
- Extract token from JSON response or cookies
- Frontend shows appropriate messages for each verification type
- Added i18n translations for TOTP UI (en, de, ja)

Closes #182
2026-02-03 07:18:13 +01:00
maziggy 65a6e7791b Fix Bambu Cloud preset lookup by transforming filament_id to setting_id
Printers report filament_id (e.g., GFA00) but the Bambu Cloud API expects
setting_id format which has an "S" inserted after "GF" (e.g., GFSA00).

- Add _filament_id_to_setting_id() helper function
- Transform IDs before API calls: GFx## -> GFSx##
- User presets (P-prefix) and already-correct IDs unchanged
- Improved warning message to show both original and transformed IDs
2026-01-28 09:34:56 +01:00
maziggy 6fb71de6a2 Add firmware update helper for LAN-only printers
Enables checking and uploading firmware updates for printers operating
  in LAN-only mode without Bambu Cloud connectivity.

  Features:
  - Automatic firmware version checking against Bambu Lab servers
  - Orange "Update" badge on printer cards when updates available
  - Firmware update modal with version info and release notes
  - One-click firmware upload to printer SD card via FTP
  - Real-time upload progress (actual bytes transferred)
  - Step-by-step instructions for triggering update from printer
  - Local firmware caching for faster re-uploads
  - Supports all Bambu Lab printer models

  New files:
  - backend/app/services/firmware_check.py - Version checking service
  - backend/app/services/firmware_update.py - Upload orchestration
  - backend/app/api/routes/firmware.py - REST API endpoints

  Also includes:
  - FTP upload progress callback support
  - 10-minute upload timeout protection
  - Firmware cache directory in .gitignore
2026-01-04 18:41:24 +01:00
maziggy ccdb084f23 - Refactored printer card's AMS section for better experience 2026-01-01 12:08:55 +01:00
maziggy 2867401116 Add Cloud Profiles template visibility and preset diff view
Cloud Profiles (ProfilesPage.tsx):
  - Add template visibility control (showInModal flag)
    - Eye/EyeOff toggle in templates modal to show/hide templates
    - Only templates with showInModal=true appear in preset modals
    - Default new templates to showInModal=true in save dialog
  - Add preset diff/compare view with two modes:
    - Compare button in edit modal (preset vs base)
    - Compare mode on main page (two-preset comparison)
    - Side-by-side diff with added/removed/changed highlighting
    - Stats showing added/removed/changed/same counts
    - Search filter and Changes/All toggle
    - Type restriction (only compare same preset types)
  - Fix array value display (show "value" instead of ["value"])
  - Fix printer preset G-code display (format escaped \n as real newlines)
  - Fix modal overflow issues with proper flex patterns
  - Fix light theme colors for compare selection text
2025-12-08 14:03:38 +00:00
maziggy e47ef36630 sync 2025-12-08 09:56:21 +00:00
Martin Ziegler 09677861ba Added screenshots 2025-11-28 10:23:59 +01:00