18 lines
1.3 KiB
Markdown
18 lines
1.3 KiB
Markdown
# REPORT — controller v0.332.0 (2026-10-19, day brief)
|
|
|
|
**Shipped and the floor for every box** (03:24 UTC, MinAgent 0.158.1, after Tester 1, demo-hp and demo-felhom took it by the
|
|
normal update path and the box walk was green on all three).
|
|
|
|
- **One sign-in for the file manager (R-1100, operator D16).** „Fájlok ↗" goes through the dashboard's one-time pass to a
|
|
host-only files cookie; traefik's forwardAuth then sets the box's secret header naming FileBrowser user
|
|
`felhom-household`. FileBrowser opens at the folder with no login; a dashboard sign-out asks again; forged headers are
|
|
refused through traefik and from an app container (only the box's secret name, the control, gets in). Fixed before the
|
|
release: a relative redirect in the forwardAuth answer (traefik pointed it at the controller), a cross-site pass and
|
|
dot-segments in `to` (a security review).
|
|
- **The typed-back escrow confirm (R-1151):** the wizard sends the two words to the agent (≥ 0.160.0), which stores the new
|
|
package only then; an older agent needs no confirm.
|
|
|
|
Tests and red-proofs: `CHANGELOG.md` v0.332.0. Live evidence: felhom.eu `documentation/audits/day-2026-10-19/` P1 (escrow),
|
|
P2 (one sign-in), P4 (release). Fixtures changed (named): `escrow_first`, `escrow_receremony`. Full report: felhom.eu
|
|
`REPORT-day-2026-10-19.md`.
|