denozord/MikrotikManager
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 104 Wiki Activity

fix(auth): закрыть обход JWT через закодированные URL

Browse Source
This commit is contained in:
Denozordec committed 2026-10-13 21:23:51 +07:00
1 parent 727e35f985
commit 7d86af7e8b
19 files changed
+1656 -23
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/ux-ui/acceptance/auth211-production-result.json
+195
View File
@@ -0,0 +1,195 @@
{
"date": "2026-10-13",
"block": "12.5.211",
"database": "mm_accept_166_1791901195054",
"baseline": false,
"cases": [
{
"path": "/api/servers",
"method": "GET",
"role": "anonymous",
"status": 401
},
{
"path": "/api/servers",
"method": "HEAD",
"role": "anonymous",
"status": 401
},
{
"path": "/api/%73ervers",
"method": "GET",
"role": "anonymous",
"status": 401
},
{
"path": "/api/%73ervers",
"method": "HEAD",
"role": "anonymous",
"status": 401
},
{
"path": "/%61pi/servers",
"method": "GET",
"role": "anonymous",
"status": 401
},
{
"path": "/%61pi/servers",
"method": "HEAD",
"role": "anonymous",
"status": 401
},
{
"path": "/%61%70%69/servers",
"method": "GET",
"role": "anonymous",
"status": 401
},
{
"path": "/%61%70%69/servers",
"method": "HEAD",
"role": "anonymous",
"status": 401
},
{
"path": "/api/gre/tunnels",
"method": "GET",
"role": "anonymous",
"status": 401
},
{
"path": "/api/gre/tunnels",
"method": "HEAD",
"role": "anonymous",
"status": 401
},
{
"path": "/%61pi/gre/tunnels",
"method": "GET",
"role": "anonymous",
"status": 401
},
{
"path": "/%61pi/gre/tunnels",
"method": "HEAD",
"role": "anonymous",
"status": 401
},
{
"path": "/api/gre/tunnels",
"method": "GET",
"role": "dashboard",
"status": 403,
"privateMaterialStored": false
},
{
"path": "/api/gre/tunnels",
"method": "PATCH",
"role": "dashboard",
"status": 403
},
{
"path": "/api/gre/tunnels",
"method": "GET",
"role": "reader",
"status": 200,
"privateMaterialStored": false
},
{
"path": "/api/gre/tunnels",
"method": "PATCH",
"role": "reader",
"status": 403
},
{
"path": "/api/gre/tunnels",
"method": "GET",
"role": "writer",
"status": 200,
"privateMaterialStored": false
},
{
"path": "/api/%67re/tunnels",
"method": "GET",
"role": "dashboard",
"status": 403,
"privateMaterialStored": false
},
{
"path": "/api/%67re/tunnels",
"method": "PATCH",
"role": "dashboard",
"status": 403
},
{
"path": "/api/%67re/tunnels",
"method": "GET",
"role": "reader",
"status": 200,
"privateMaterialStored": false
},
{
"path": "/api/%67re/tunnels",
"method": "PATCH",
"role": "reader",
"status": 403
},
{
"path": "/api/%67re/tunnels",
"method": "GET",
"role": "writer",
"status": 200,
"privateMaterialStored": false
},
{
"path": "/%61pi/gre/tunnels",
"method": "GET",
"role": "dashboard",
"status": 403,
"privateMaterialStored": false
},
{
"path": "/%61pi/gre/tunnels",
"method": "PATCH",
"role": "dashboard",
"status": 403
},
{
"path": "/%61pi/gre/tunnels",
"method": "GET",
"role": "reader",
"status": 200,
"privateMaterialStored": false
},
{
"path": "/%61pi/gre/tunnels",
"method": "PATCH",
"role": "reader",
"status": 403
},
{
"path": "/%61pi/gre/tunnels",
"method": "GET",
"role": "writer",
"status": 200,
"privateMaterialStored": false
},
{
"path": "/api/auth/config",
"role": "anonymous",
"status": 200,
"publicConfig": true
},
{
"path": "/%61pi/auth/config",
"role": "anonymous",
"status": 200,
"publicConfig": true
}
],
"scope": "Production compiled canonical auth/RBAC using own restricted PostgreSQL, local native HTTP fixture and synthetic JWT/PSK",
"passed": true,
"nativeWrites": 0,
"databaseAndRoleRemoved": true
}