ospab c2a1a53b4d fix(server): audit-log API endpoints had no auth check at all ... GET/POST/DELETE /api/audit were the only three handlers in the whole Management API that never called check_token() - every other endpoint (status, users, rules, config) does. Concretely, with the panel's credentials configured, an unauthenticated request could still: - read the full audit log (GET) - inject arbitrary forged entries, e.g. fake "success" events to cover tracks (POST) - wipe the entire audit log (DELETE) - the exact mechanism meant to detect and investigate unauthorized actions, erasable with zero auth Added the same check_token() gate the rest of the file uses, and fixed these three handlers' raw .unwrap() on the audit_logs lock to the poison-recovery pattern (unwrap_or_else(|e| e.into_inner())) used everywhere else, for consistency. Added focused unit tests on check_token() itself (missing header, correct/ wrong bearer, raw token, session token, and the documented open-panel mode when no credentials are configured) - it's the single gate every sensitive handler depends on, worth pinning down independently of any one handler.		2026-07-18 17:27:58 +03:00
..
src	fix(server): audit-log API endpoints had no auth check at all	2026-07-18 17:27:58 +03:00
Cargo.toml	feat: implement built-in DNS server, adblock and dns leak prevention	2026-06-07 19:55:42 +03:00