denozord/MikrotikManager
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 104 Wiki Activity

fix(auth): закрыть обход JWT через закодированные URL

Browse Source
This commit is contained in:
Denozordec committed 2026-10-13 21:23:51 +07:00
1 parent 727e35f985
commit 7d86af7e8b
19 files changed
+1656 -23
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/ux-ui/acceptance/auth211-live-2026-10-13.json
+193
View File
@@ -0,0 +1,193 @@
{
"date": "2026-10-13",
"block": "12.5.211",
"backend": "ux-auth211",
"frontend": "ux-gre210",
"cases": [
{
"role": "anonymous",
"path": "/api/servers",
"method": "GET",
"status": 401
},
{
"role": "anonymous",
"path": "/api/servers",
"method": "HEAD",
"status": 401
},
{
"role": "anonymous",
"path": "/api/%73ervers",
"method": "GET",
"status": 401
},
{
"role": "anonymous",
"path": "/api/%73ervers",
"method": "HEAD",
"status": 401
},
{
"role": "anonymous",
"path": "/%61pi/servers",
"method": "GET",
"status": 401
},
{
"role": "anonymous",
"path": "/%61pi/servers",
"method": "HEAD",
"status": 401
},
{
"role": "anonymous",
"path": "/%61%70%69/servers",
"method": "GET",
"status": 401
},
{
"role": "anonymous",
"path": "/%61%70%69/servers",
"method": "HEAD",
"status": 401
},
{
"role": "dashboard",
"path": "/api/servers",
"method": "GET",
"status": 403,
"privateMaterialAbsent": true
},
{
"role": "dashboard",
"path": "/api/%73ervers",
"method": "GET",
"status": 403,
"privateMaterialAbsent": true
},
{
"role": "dashboard",
"path": "/%61pi/servers",
"method": "GET",
"status": 403,
"privateMaterialAbsent": true
},
{
"role": "dashboard",
"path": "/api/gre/tunnels",
"method": "GET",
"status": 403,
"pskAbsent": true
},
{
"role": "dashboard",
"path": "/api/gre/tunnels",
"method": "PATCH",
"status": 403,
"emptyBody": true,
"nativeApplication": false
},
{
"role": "dashboard",
"path": "/api/%67re/tunnels",
"method": "GET",
"status": 403,
"pskAbsent": true
},
{
"role": "dashboard",
"path": "/api/%67re/tunnels",
"method": "PATCH",
"status": 403,
"emptyBody": true,
"nativeApplication": false
},
{
"role": "dashboard",
"path": "/%61pi/gre/tunnels",
"method": "GET",
"status": 403,
"pskAbsent": true
},
{
"role": "dashboard",
"path": "/%61pi/gre/tunnels",
"method": "PATCH",
"status": 403,
"emptyBody": true,
"nativeApplication": false
},
{
"role": "reader",
"path": "/api/servers",
"method": "GET",
"status": 200,
"privateMaterialAbsent": true
},
{
"role": "reader",
"path": "/api/%73ervers",
"method": "GET",
"status": 200,
"privateMaterialAbsent": true
},
{
"role": "reader",
"path": "/%61pi/servers",
"method": "GET",
"status": 200,
"privateMaterialAbsent": true
},
{
"role": "reader",
"path": "/api/gre/tunnels",
"method": "GET",
"status": 200,
"pskAbsent": true
},
{
"role": "reader",
"path": "/api/gre/tunnels",
"method": "PATCH",
"status": 403,
"emptyBody": true,
"nativeApplication": false
},
{
"role": "reader",
"path": "/api/%67re/tunnels",
"method": "GET",
"status": 200,
"pskAbsent": true
},
{
"role": "reader",
"path": "/api/%67re/tunnels",
"method": "PATCH",
"status": 403,
"emptyBody": true,
"nativeApplication": false
},
{
"role": "reader",
"path": "/%61pi/gre/tunnels",
"method": "GET",
"status": 200,
"pskAbsent": true
},
{
"role": "reader",
"path": "/%61pi/gre/tunnels",
"method": "PATCH",
"status": 403,
"emptyBody": true,
"nativeApplication": false
}
],
"publicAuthConfig": 200,
"realPortalJWT": true,
"rawResponseBodiesStored": false,
"ownedUsersRemoved": true,
"scope": "Anonymous GET/HEAD and actual restricted roles; denied PATCH uses empty body and cannot apply native objects"
}