admin
0c6ce9500c
gates / gates (push) Successful in 46s
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
30 lines
1.8 KiB
Markdown
30 lines
1.8 KiB
Markdown
# REPORT — v0.327.0: FileBrowser published only after its default login is checked; real memory amounts in the install check (2026-10-17)
|
|
|
|
Brief „FileBrowser never on its default password (D11 = A), real memory amounts (D10 = A), CI failure mail, STATUS".
|
|
Full report: felhom.eu `REPORT-filebrowser-memory-ci-2026-10-17.md`. Evidence: felhom.eu
|
|
`documentation/audits/filebrowser-memory-ci-2026-10-17/`.
|
|
|
|
## 1. What changed
|
|
|
|
- **R-1126:** `internal/infra/infra.go` (FileBrowser on `felhom-filebrowser`, not `traefik-public`), `internal/stacks/filebrowser_gate.go`
|
|
(join, check, publish by container ID), `internal/stacks/infra.go` and `internal/web/handlers.go` (call sites).
|
|
- **R-1125:** `err.stacks.not_enough_memory` and `deploy.nincs_eleg_memoria_foglalas_telepites` reworded (HU/EN);
|
|
`stacks.InstallMemory` shared by the check and the install page.
|
|
|
|
## 2. Tests (each red-proved)
|
|
|
|
`TestFileBrowserRender_R1126_NotPublicAtStart`, `TestFileBrowserGate_PublishedOnlyAfterTheCheck`,
|
|
`TestFileBrowserGate_ConnectsTheCheckedContainerById`, `TestR1125_NotEnoughMemorySaysWhatToDo`,
|
|
`TestR1125_InstallMemoryIsTheChecksReading`. Fixtures: two re-captured as `*_r1125`; every other byte-identical.
|
|
|
|
## 3. Live (scratch 9202)
|
|
|
|
FileBrowser + its data removed: 143 probes through Traefik, the default login never 200. Install of a 150 MB app with
|
|
50 MB free: refused (400) in HU and EN, nothing installed; the page showed the same numbers as the check (2,798 vs 2,698).
|
|
|
|
## 4. Observations
|
|
|
|
1. FileBrowser's own admin-password setting re-applies at every start (measured). NOT-A-FINDING: why Path 2 was built.
|
|
2. The install page used `/proc`'s host-wide memory, not the check's reading. NOT-A-FINDING: fixed in this release.
|
|
3. A TOCTOU in the first gate (connect by name). NOT-A-FINDING: found by the commit security review, fixed before release.
|