maziggy 3fa9ed2b91 Add authentication to 200+ API endpoints (CVE-2026-25505) ...

Security fix for critical vulnerability (CVSS 9.8) where API endpoints
were accessible without authentication when auth was enabled.

Changes:
- Add RequirePermissionIfAuthEnabled() to all unprotected route files:
  archives, projects, settings, api_keys, groups, cloud, github_backup,
  support, notifications, notification_templates, maintenance, filaments,
  external_links, smart_plugs, discovery, firmware, kprofiles, camera,
  ams_history, pending_uploads, updates, spoolman, system, print_queue,
  printers
- Keep image-serving endpoints (thumbnails, timelapse, photos, camera
  streams, icons) unauthenticated since <img> tags cannot send headers
- Add backend integration tests for endpoint auth enforcement
- Add frontend tests for ownership-based permissions (canModify)

Fixes: CVE-2026-25505

2026-02-03 08:44:07 +01:00

..

__init__.py

Add comprehensive automated testing infrastructure

2025-12-11 10:03:40 +01:00

test_ams_history_api.py

- Add interactive API Browser to Settings > API Keys

2026-01-02 15:00:21 +01:00

test_archives_api.py

Add tag management feature (Issue #183)

2026-01-31 08:24:06 +01:00

test_auth_api.py

Location filter for queue and auth fixes (Issue #220)

2026-02-02 07:39:58 +01:00

test_camera_api.py

Improved docker tests

2026-01-30 13:54:20 +01:00

test_discovery_api.py

- Add subnet scanning for printer discovery in Docker environments

2025-12-28 09:40:47 +01:00

test_endpoint_auth.py

Add authentication to 200+ API endpoints (CVE-2026-25505)

2026-02-03 08:44:07 +01:00

test_external_links_api.py

- Add interactive API Browser to Settings > API Keys

2026-01-02 15:00:21 +01:00

test_filaments_api.py

- Add interactive API Browser to Settings > API Keys

2026-01-02 15:00:21 +01:00

test_github_backup_api.py

Add GitHub profile backup feature

2026-01-27 15:01:06 +01:00

test_library_api.py

Issue #224: File Manager Permissions

2026-02-02 08:01:42 +01:00

test_maintenance_api.py

- Add interactive API Browser to Settings > API Keys

2026-01-02 15:00:21 +01:00

test_metrics_api.py

Add Prometheus metrics endpoint for external monitoring (#161)

2026-01-27 16:49:28 +01:00

test_notifications_api.py

- Add interactive API Browser to Settings > API Keys

2026-01-02 15:00:21 +01:00

test_ownership_permissions.py

Fix critical security vulnerabilities (GHSA-gc24-px2r-5qmf)

2026-02-02 06:51:55 +01:00

test_print_lifecycle.py

Fix backend code formatting for CI

2026-01-11 07:30:22 +01:00

test_print_queue_api.py

Location filter for queue and auth fixes (Issue #220)

2026-02-02 07:39:58 +01:00

test_printers_api.py

Add user tracking for prints, archives, library files, and queue (Issue #206)

2026-02-01 10:26:11 +01:00

test_projects_api.py

Add project import/export with ZIP file support

2026-01-25 13:17:15 +01:00

test_settings_api.py

Changed tests for new backup module

2026-02-01 09:18:31 +01:00

test_smart_plugs_api.py

Make MQTT JSON path optional for smart plug monitoring (#173)

2026-01-30 17:18:22 +01:00

test_spoolman_api.py

Spoolman: Show "Open in Spoolman" for linked spools (Issue #210)

2026-02-02 09:23:50 +01:00

test_support_api.py

Adds a live log viewer component to the Support & Troubleshooting section

2026-01-20 16:11:45 +01:00

test_system_api.py

- Add interactive API Browser to Settings > API Keys

2026-01-02 15:00:21 +01:00

test_updates_api.py

- Docker update detection for in-app updates

2026-01-01 14:06:06 +01:00

test_virtual_printer_api.py

Add virtual printer Queue mode and sidebar badge indicators

2026-01-17 13:30:00 +01:00