Nicola Murino 98f7e467ab dataprovider: refuse self-service writes made from a stale snapshot ...

A user or admin changing its own password, profile or two-factor
settings wrote the whole account back and could overwrite a concurrent
administrator change. Self-service updates are now conditional on the
stored updated_at matching the value read, and every update stores a
strictly increasing updated_at.

Thanks to Thomas Toth for the report.

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>

2026-09-07 21:07:59 +02:00

..

api_admin.go

dataprovider: refuse self-service writes made from a stale snapshot

2026-09-07 21:07:59 +02:00

api_configs.go

httpd: bind the OAuth2 token request to the browser that started it

2026-08-12 23:32:35 +02:00

api_defender.go

add an util method to convert []byte to string

2024-05-08 19:01:58 +02:00

api_eventrule.go

JWT: replace jwtauth/jwx with lightweight wrapper around go-jose

2025-10-08 18:10:39 +02:00

api_events.go

replace golangci-lint with staticcheck, errcheck and unparam

2026-08-24 15:11:34 +02:00

api_folder.go

JWT: replace jwtauth/jwx with lightweight wrapper around go-jose

2025-10-08 18:10:39 +02:00

api_group.go

JWT: replace jwtauth/jwx with lightweight wrapper around go-jose

2025-10-08 18:10:39 +02:00

api_http_user.go

replace golangci-lint with staticcheck, errcheck and unparam

2026-08-24 15:11:34 +02:00

api_iplist.go

JWT: replace jwtauth/jwx with lightweight wrapper around go-jose

2025-10-08 18:10:39 +02:00

api_keys.go

JWT: replace jwtauth/jwx with lightweight wrapper around go-jose

2025-10-08 18:10:39 +02:00

api_maintenance.go

replace golangci-lint with staticcheck, errcheck and unparam

2026-08-24 15:11:34 +02:00

api_mfa.go

replace golangci-lint with staticcheck, errcheck and unparam

2026-08-24 15:11:34 +02:00

api_quota.go

replace golangci-lint with staticcheck, errcheck and unparam

2026-08-24 15:11:34 +02:00

api_retention.go

JWT: replace jwtauth/jwx with lightweight wrapper around go-jose

2025-10-08 18:10:39 +02:00

api_role.go

JWT: replace jwtauth/jwx with lightweight wrapper around go-jose

2025-10-08 18:10:39 +02:00

api_shares.go

httpd: check the account state when a public share is served

2026-09-07 19:57:00 +02:00

api_user.go

JWT: replace jwtauth/jwx with lightweight wrapper around go-jose

2025-10-08 18:10:39 +02:00

api_utils.go

dataprovider: refuse self-service writes made from a stale snapshot

2026-09-07 21:07:59 +02:00

auth_utils.go

replace golangci-lint with staticcheck, errcheck and unparam

2026-08-24 15:11:34 +02:00

file.go

upgrade golangci-lint to v2

2025-03-29 11:36:19 +01:00

flash_test.go

remove end year from Copyright notice in files

2024-01-01 11:31:45 +01:00

flash.go

remove end year from Copyright notice in files

2024-01-01 11:31:45 +01:00

handler.go

replace golangci-lint with staticcheck, errcheck and unparam

2026-08-24 15:11:34 +02:00

httpd_test.go

dataprovider: refuse self-service writes made from a stale snapshot

2026-09-07 21:07:59 +02:00

httpd.go

httpd: improvements to the static files handling

2026-08-31 21:15:42 +02:00

internal_test.go

dataprovider: refuse self-service writes made from a stale snapshot

2026-09-07 21:07:59 +02:00

middleware.go

replace golangci-lint with staticcheck, errcheck and unparam

2026-08-24 15:11:34 +02:00

oauth2_test.go

db shared sessions: set key and type as primary key

2025-03-23 11:34:10 +01:00

oauth2.go

replace golangci-lint with staticcheck, errcheck and unparam

2026-08-24 15:11:34 +02:00

oidc_test.go

httpd: bind the OIDC authorization request to the browser that started it

2026-08-12 23:32:26 +02:00

oidc.go

replace golangci-lint with staticcheck, errcheck and unparam

2026-08-24 15:11:34 +02:00

oidcmanager.go

replace golangci-lint with staticcheck, errcheck and unparam

2026-08-24 15:11:34 +02:00

resetcode.go

replace golangci-lint with staticcheck, errcheck and unparam

2026-08-24 15:11:34 +02:00

resources_embedded.go

remove obsoletes build constraints

2025-04-20 17:15:40 +02:00

resources.go

remove obsoletes build constraints

2025-04-20 17:15:40 +02:00

server.go

dataprovider: refuse self-service writes made from a stale snapshot

2026-09-07 21:07:59 +02:00

token.go

replace golangci-lint with staticcheck, errcheck and unparam

2026-08-24 15:11:34 +02:00

web.go

replace strings.Split with SplitSeq

2025-05-31 19:03:41 +02:00

webadmin.go

dataprovider: refuse self-service writes made from a stale snapshot

2026-09-07 21:07:59 +02:00

webclient.go

replace golangci-lint with staticcheck, errcheck and unparam

2026-08-24 15:11:34 +02:00

webtask_test.go

WebClient: refactor long-running tasks to improve browser compatibility

2024-03-11 18:19:57 +01:00

webtask.go

replace golangci-lint with staticcheck, errcheck and unparam

2026-08-24 15:11:34 +02:00