v0.324.0: the database password comes back with the data (R-1106, R-127b, R-926); restic 0.19.1 (R-1107); R-1108, R-1065, R-1017; dashboard hardening (R-983, R-976)

2026-10-16 22:46:00 +02:00
parent 00a0d91976
commit f75b3aa778
212 changed files with 2414 additions and 398 deletions
@@ -48,9 +48,11 @@ import (
 var secretNameRe = regexp.MustCompile(`(?i)(pass(word|phrase)|secret|token|api_?key|private_?key|recovery_?code|credential|_key$)`)

 // notSecretNames are names the pattern matches that carry no secret: the CSRF tokens a form must carry
-// (session-bound, useless without the session) and a password-change ERROR MESSAGE.
+// (session-bound, useless without the session) and a password-change ERROR MESSAGE. LogoutToken (R-983, v0.324.0) is
+// the family sign-out form's CSRF token: an HMAC naming the family session, useless without that session's cookie.
 var notSecretNames = map[string]bool{
 	"CSRFToken": true, "CSRFField": true, "FormToken": true, "LangCSRF": true, "PasswordError": true,
+	"LogoutToken": true,
 }

 const plantedPrefix = "PLANTEDSECRET"