mixandClaude Opus 5.5
e9d2cbbe28
The review of 2c27275..2c8e981 (read-only, a separate agent) found no high or medium; three small ones, fixed here: - reauth took a limiter attempt before the compare, right password included: with A2 asking on every user save, ten saves in fifteen minutes locked the administrator out of Account's password change, the backup and the export. A right password now gives its attempt back (rateLimiter.Refund, Module.PasswordCheckPassed; a bucket already at its limit stays blocked). TestRightAccountPasswordsDoNotUseUpTheLimit. - LoggedPath hid the tokens of /login/reset/ and /confirm/ but not of the first administrator's /setup/<token>; now it does (test case added). - The entrypoint's own `[ -e ] || : >` lines (sender_login_maps, the four inbound maps, mail.log) get the `[ -L ]` guard postfix-config.sh got for I2. Safe before too - drop_links runs first on those paths and the panel is not running yet - this is the belt and braces. The review also confirmed, with a probe of the regex against Postfix's formats, that a port-25 client can place only its own envelope in an Inbound log row, and that every path to a password, e-mail or role asks for the signed-in password. go test ./internal/web/handlers ./internal/web/auth; sh -n entrypoint.sh. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
21 lines
604 B
Go
21 lines
604 B
Go
package auth
|
|
|
|
import "testing"
|
|
|
|
// A rejected request's path is logged without the token of a link
|
|
// (security review, 2026-10-17).
|
|
func TestLoggedPathHidesTokens(t *testing.T) {
|
|
for in, want := range map[string]string{
|
|
"/login/reset/abcDEF123": "/login/reset/…",
|
|
"/confirm/abcDEF123": "/confirm/…",
|
|
"/setup/abcDEF123": "/setup/…",
|
|
"/login/reset": "/login/reset",
|
|
"/confirm/": "/confirm/",
|
|
"/account/profile": "/account/profile",
|
|
} {
|
|
if got := LoggedPath(in); got != want {
|
|
t.Errorf("LoggedPath(%q) = %q, want %q", in, got, want)
|
|
}
|
|
}
|
|
}
|