ericanannn-blip 3051aebb28 fix(middleware): log rejected CSRF requests with the trusted client address (#6692) ... A panel or API request rejected for a missing or wrong CSRF token got a bare 403 and left nothing in the log, so an operator chasing failed logins from a stale tab or a script had no trace. CSRFMiddleware now logs a warning with the method, path and client address. The address comes from getRemoteIp, which honours the trusted-proxy list, instead of gin's ClientIP, which trusts any peer's X-Forwarded-For.		2026-10-24 04:51:21 +02:00
..
bodylimit.go	fix(web): tighten database restore body-cap exemption (#5609)	2026-06-28 15:00:55 +02:00
bodylimit_test.go	fix(web): tighten database restore body-cap exemption (#5609)	2026-06-28 15:00:55 +02:00
config_envelope.go	feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)	2026-06-16 12:19:33 +02:00
config_envelope_test.go	feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)	2026-06-16 12:19:33 +02:00
domainValidator.go
security.go	fix(middleware): log rejected CSRF requests with the trusted client address (#6692)	2026-10-24 04:51:21 +02:00
security_test.go	fix(middleware): log rejected CSRF requests with the trusted client address (#6692)	2026-10-24 04:51:21 +02:00
validate.go	refactor(frontend): move form-item hints from extra to tooltip	2026-06-17 17:24:16 +02:00
validate_mutation_test.go	Test-quality audit: fix 2 prod bugs, strengthen weak tests, add mutation/fuzz/CI tooling (#5345)	2026-06-15 15:17:03 +02:00
validate_protocol_test.go	fix(inbounds): accept masque in the inbound protocol validator	2026-10-11 10:56:47 +02:00
validate_test.go