v0.324.0: the database password comes back with the data (R-1106, R-127b, R-926); restic 0.19.1 (R-1107); R-1108, R-1065, R-1017; dashboard hardening (R-983, R-976)

2026-10-16 22:46:00 +02:00
parent 00a0d91976
commit f75b3aa778
212 changed files with 2414 additions and 398 deletions
@@ -125,6 +125,7 @@ func TestR35_LogoutEndsSessionAcrossRestart(t *testing.T) {
 		t.Fatal("setup: the session must survive one restart first")
 	}
 	req := httptest.NewRequest(http.MethodPost, "/logout", nil)
+	req.Header.Set(csrfHeaderName, s2.csrfTokenForSession(tok)) // R-983: the sign-out carries the session's token
 	req.AddCookie(&http.Cookie{Name: sessionCookieName, Value: tok})
 	s2.handleLogout(httptest.NewRecorder(), req)
 	if s2.isValidSession(tok) {
@@ -235,6 +236,7 @@ func TestR35_FailedLogoutSaveRemovesFile(t *testing.T) {
 		t.Fatal(err)
 	}
 	req := httptest.NewRequest(http.MethodPost, "/logout", nil)
+	req.Header.Set(csrfHeaderName, s2.csrfTokenForSession(tok)) // R-983: the sign-out carries the session's token
 	req.AddCookie(&http.Cookie{Name: sessionCookieName, Value: tok})
 	s2.handleLogout(httptest.NewRecorder(), req)
 	s2.Close()