A user or admin changing its own password, profile or two-factor
settings wrote the whole account back and could overwrite a concurrent
administrator change. Self-service updates are now conditional on the
stored updated_at matching the value read, and every update stores a
strictly increasing updated_at.
Thanks to Thomas Toth for the report.
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
Apply the fixes suggested by the modernize analyzers enabled by
default in gopls v0.23: range over int, errors.AsType, min/max,
slices.Backward/Contains, maps.Copy, strings.Cut/CutPrefix/CutSuffix/
SplitSeq, fmt.Appendf, WaitGroup.Go and b.Loop in tests, new(expr)
instead of to.Ptr, removal of ineffective omitempty tags on nested
struct fields.
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
Share usage was a check-then-write race: the public share handler
loaded a copy of the share, IsUsable() checked UsedTokens on that
in-memory snapshot, and UpdateShareLastUse() incremented the counter
afterwards with no lock, transaction or compare-and-swap spanning the
check. Concurrent requests for the same share could all pass the limit
check before any of them incremented the counter, so a share with a
usage cap (for example max_tokens=1) could be downloaded or uploaded
more times than allowed under concurrent access.
The usage count is now a conditional atomic reservation. For a positive
delta the SQL providers run a single guarded UPDATE that only succeeds
while used_tokens + n <= max_tokens and reject the request when no row
is affected; the memory and bolt providers apply the same guard inside
their existing locked section. UpdateShareLastUse returns
ErrShareUsageExceeded when the reservation would exceed the limit, and
the share download/upload handlers reject the request instead of
serving it. A non-positive delta is a refund and is always applied
unconditionally, so failed transfers still return their reserved token.
Thanks to Vishal Shukla (@shukla304) for the report.
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
Folders and groups now retain their initial order, improving compatibility
and predictability when used with Terraform
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
Setting configurations is an experimental feature and is not currently
supported in the REST API
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
this is a backward incompatible change, all previous file based IP/network
lists will not work anymore
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
Nicola Murino