5 Commits

Include renames

Author	SHA1	Message	Date
maziggy	3fa9ed2b91	Add authentication to 200+ API endpoints (CVE-2026-25505) ... Security fix for critical vulnerability (CVSS 9.8) where API endpoints were accessible without authentication when auth was enabled. Changes: - Add RequirePermissionIfAuthEnabled() to all unprotected route files: archives, projects, settings, api_keys, groups, cloud, github_backup, support, notifications, notification_templates, maintenance, filaments, external_links, smart_plugs, discovery, firmware, kprofiles, camera, ams_history, pending_uploads, updates, spoolman, system, print_queue, printers - Keep image-serving endpoints (thumbnails, timelapse, photos, camera streams, icons) unauthenticated since <img> tags cannot send headers - Add backend integration tests for endpoint auth enforcement - Add frontend tests for ownership-based permissions (canModify) Fixes: CVE-2026-25505	2026-02-03 08:44:07 +01:00
maziggyandClaude Opus 4.5	1234e44eb2	- Docker update detection for in-app updates ... - Added _is_docker_environment() function - Check endpoint returns is_docker and update_method fields - Apply endpoint rejects Docker with helpful instructions - Added updates API tests - Updated CHANGELOG 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-01 14:06:06 +01:00
maziggy	bc23db0149	Fixed version number parsing in update module	2025-12-14 17:00:00 +01:00
maziggy	ce18b38264	Fixed os.path issue in update module	2025-12-08 17:58:20 +00:00
Martin Ziegler	8571236bc0	Added update module	2025-12-01 07:34:25 +01:00