maziggy
3fa9ed2b91
Add authentication to 200+ API endpoints (CVE-2026-25505)
...
Security fix for critical vulnerability (CVSS 9.8) where API endpoints
were accessible without authentication when auth was enabled.
Changes:
- Add RequirePermissionIfAuthEnabled() to all unprotected route files:
archives, projects, settings, api_keys, groups, cloud, github_backup,
support, notifications, notification_templates, maintenance, filaments,
external_links, smart_plugs, discovery, firmware, kprofiles, camera,
ams_history, pending_uploads, updates, spoolman, system, print_queue,
printers
- Keep image-serving endpoints (thumbnails, timelapse, photos, camera
streams, icons) unauthenticated since <img> tags cannot send headers
- Add backend integration tests for endpoint auth enforcement
- Add frontend tests for ownership-based permissions (canModify)
Fixes: CVE-2026-25505
2026-02-03 08:44:07 +01:00
maziggy
8acc91d3cd
- Add subnet scanning for printer discovery in Docker environments
...
- Detect Docker environment automatically via /.dockerenv and cgroup
- Show subnet input field in Add Printer dialog when running in Docker
- Scan IP range for Bambu printer ports (8883 MQTT, 990 FTPS)
- Query SSDP to get printer name/serial/model from discovered IPs
- Map raw SSDP model codes to friendly names (BL-P001→X1C, O1D→H2D)
2025-12-28 09:40:47 +01:00
maziggy