The review of 2c27275..2c8e981 (read-only, a separate agent) found no high
or medium; three small ones, fixed here:
- reauth took a limiter attempt before the compare, right password
included: with A2 asking on every user save, ten saves in fifteen
minutes locked the administrator out of Account's password change, the
backup and the export. A right password now gives its attempt back
(rateLimiter.Refund, Module.PasswordCheckPassed; a bucket already at its
limit stays blocked). TestRightAccountPasswordsDoNotUseUpTheLimit.
- LoggedPath hid the tokens of /login/reset/ and /confirm/ but not of the
first administrator's /setup/<token>; now it does (test case added).
- The entrypoint's own `[ -e ] || : >` lines (sender_login_maps, the four
inbound maps, mail.log) get the `[ -L ]` guard postfix-config.sh got for
I2. Safe before too - drop_links runs first on those paths and the panel
is not running yet - this is the belt and braces.
The review also confirmed, with a probe of the regex against Postfix's
formats, that a port-25 client can place only its own envelope in an
Inbound log row, and that every path to a password, e-mail or role asks
for the signed-in password.
go test ./internal/web/handlers ./internal/web/auth; sh -n entrypoint.sh.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding A4 (low), stage 0. The line logged when
a request carries two unprefixed session cookies printed r.URL.Path raw,
so GET /confirm/<token> wrote the token to the log (reachable only with
PANEL_COOKIE_SECURE=false, where a sibling host can plant the bare name).
loggedPath moves from internal/web to internal/web/auth as LoggedPath
(web imports auth, not the other way) and both lines - the origin check's
refusal and the duplicate-cookie one - go through it.
Tests: TestDuplicateCookieLineHidesALinksToken; TestLoggedPathHidesTokens
moved with the function. go test ./internal/web ./internal/web/auth.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mixandClaude Opus 5.5