admin
b50289074d
gates / gates (push) Successful in 28s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
20 lines
2.8 KiB
Markdown
20 lines
2.8 KiB
Markdown
# Catalog sweep 3/4 — READ in source at each pinned tag (not measured live). Subagent report 2026-10-01, condensed.
|
|
Apps: n8n navidrome nextcloud onlyoffice opengist outline paperless-ngx papra plant-it plex privatebin radarr radicale rallly.
|
|
|
|
| App (pin) | How | Used for | Verdict | Evidence |
|
|
|---|---|---|---|---|
|
|
| n8n 2.42.1 | Express trust proxy hop count (`N8N_PROXY_HOPS`=0) | IP limit 1000/5min + per email | SAFE; optional `N8N_PROXY_HOPS=2` | packages/@n8n/config/src/index.ts:266-268 |
|
|
| navidrome 0.64.2 | peer unless ExtAuth.TrustedSources set (not set) | login 5/20s per IP | SAFE. **Never set the whitelist** (opens Remote-User login) | server/middlewares.go:171-201 |
|
|
| nextcloud 34.0.4 | Apache mod_remoteip X-Real-IP from private; core trusted_proxies from the right | brute-force throttle by IP | SAFE as is (tunnel = one bucket); `TRUSTED_PROXIES=172.16.0.0/12` → real client | Request.php:591-631; Throttler.php:50-59 |
|
|
| onlyoffice 9.4.0 | leftmost XFF only with ipfilter on (off) | — | SAFE; never enable ipfilter | Common/sources/utils.js:1052-1066 |
|
|
| opengist 1.15 | echo RealIP LEFTMOST | logs only | log text forgeable → router reset | echo context.go:309-331 |
|
|
| outline 1.10.1 | Koa proxy LEFTMOST (`PROXY_IP_HEADER` X-Forwarded-For) | per-IP limits; sign-in link bound to IP | RISK → router reset (or `PROXY_IP_HEADER=X-Real-IP`) | server/services/web.ts:31-39; rateLimiter.ts:31-52 |
|
|
| paperless-ngx 2.20.15 | allauth 65.12.1 LEFTMOST | login_failed 10/m/ip + 5/300s/username | RISK (per-IP part) → router reset | allauth account/adapter.py:774-780 |
|
|
| papra 26.6.2 | better-auth LEFTMOST; invalid → rate limit SKIPPED | sign-in/up limit per IP | RISK (junk value turns the limit off) → router reset (or `AUTH_IP_ADDRESS_HEADERS=x-real-ip`) | auth.config.ts:70-82; better-auth rate-limiter/index.ts:167-171 |
|
|
| plant-it 0.10.0 | LEFTMOST | per-IP limiter in an unbounded map | RISK (evasion + memory growth) → router reset | RateLimitFilter.java:36-60 |
|
|
| plex 1.41.4 | closed source; XFF "in most places" (inferred) | allowedNetworks auth bypass (unset) | SAFE as templated; never set ALLOWED_NETWORKS | forum links (inferred) |
|
|
| privatebin 2.0.6 | only with `[traffic] header` (unset) | paste flood limit | SAFE; never `X_FORWARDED_FOR` | TrafficLimiter.php:52-154 |
|
|
| radarr 6.4.4 | ASP.NET from the right, TrustedNetworks (loopback) | local-address auth bypass (needs no leftover XFF) | SAFE; optional TrustedNetworks 172.16.0.0/12 | ForwardedHeadersConfigurator.cs:15-38 |
|
|
| radicale 3.8.1 | REMOTE_ADDR | logs | SAFE | radicale/app/__init__.py:449-458 |
|
|
| rallly 4.15.3 | better-auth (multi-hop unresolvable → shared); /api/event LEFTMOST | sign-in limits; /api/event limit | auth SAFE; /api/event forgeable → router reset | better-auth utils/ip.ts:283-372; api/event route.ts:72-79 |
|