Re-Quest/adminpanel
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): resolve audit findings — debug log, payment bypass, images #1

Merged
sathish merged 1 commits from fix/security-audit into main 2026-08-04 13:18:52 +00:00
Conversation 0 Commits 1 Files Changed 3 +5 -58
sathish commented 2026-08-04 13:13:48 +00:00
Member
Copy Link

Addresses the RE:Quest code-audit findings for the admin panel.

Changes

  • Remove firebase-debug.log from the codebase and gitignore it
    (firebase-debug.log*). It contained authorizing via signed-in user (ppradeepd@gmail.com) — a developer's personal Google account, indicating
    Firebase/GCP resources may have been administered under a personal vendor
    account.
  • Remove the client-side skipPaymentCheck approval flag. Investigation
    finding: the flag was inert. It was declared on an inline request-body type and
    the backend only ever reads status and note, so it never reached the server —
    it only selected which branch of this page's own confirmation modal ran. Removing
    it changes no server behaviour.
  • Replace the wildcard image remote host "**" with an explicit allowlist
    (Contabo, AWS, DigitalOcean Spaces), closing the SSRF/abuse surface.

History rewrite (already applied to main)

firebase-debug.log was present in all 74 commits, so removing the file alone did
not close the finding. main has been rewritten with git-filter-repo and
force-pushed. Verified: the file and the personal email address now appear in zero
commits, and the old commit objects are pruned locally.

Everyone must delete their adminpanel clone and re-clone. A git pull onto an
existing clone merges the old commits — and the file — back in, and pushing from a
stale clone would restore it to the remote.

Follow-up for whoever administers the Gitea instance

Please run garbage collection on this repository. The old commits are unreferenced
but may remain as dangling objects reachable by direct SHA URL until GC runs, which
would leave the leaked address retrievable despite the rewrite.

Verification

next build clean. Working tree byte-identical to pre-rewrite — only history changed.

Addresses the RE:Quest code-audit findings for the admin panel. ## Changes - **Remove `firebase-debug.log`** from the codebase and gitignore it (`firebase-debug.log*`). It contained `authorizing via signed-in user (ppradeepd@gmail.com)` — a developer's personal Google account, indicating Firebase/GCP resources may have been administered under a personal vendor account. - **Remove the client-side `skipPaymentCheck` approval flag.** Investigation finding: the flag was inert. It was declared on an inline request-body type and the backend only ever reads `status` and `note`, so it never reached the server — it only selected which branch of this page's own confirmation modal ran. Removing it changes no server behaviour. - **Replace the wildcard image remote host `"**"`** with an explicit allowlist (Contabo, AWS, DigitalOcean Spaces), closing the SSRF/abuse surface. ## History rewrite (already applied to `main`) `firebase-debug.log` was present in all 74 commits, so removing the file alone did not close the finding. `main` has been rewritten with `git-filter-repo` and force-pushed. Verified: the file and the personal email address now appear in zero commits, and the old commit objects are pruned locally. **Everyone must delete their adminpanel clone and re-clone.** A `git pull` onto an existing clone merges the old commits — and the file — back in, and pushing from a stale clone would restore it to the remote. ## Follow-up for whoever administers the Gitea instance Please run garbage collection on this repository. The old commits are unreferenced but may remain as dangling objects reachable by direct SHA URL until GC runs, which would leave the leaked address retrievable despite the rewrite. ## Verification `next build` clean. Working tree byte-identical to pre-rewrite — only history changed.
sathish added 1 commit 2026-08-04 13:13:48 +00:00
fix(security): resolve audit findings — debug log, payment bypass, images df16a76909 
- Remove the committed firebase-debug.log (contains a personal Google
  account) and gitignore it. NOTE: still present in history — a history
  rewrite or written confirmation is still outstanding
- Remove the client-side skipPaymentCheck approval bypass
- Replace the wildcard image remote host "**" with an explicit allowlist
  (adds DigitalOcean Spaces)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
sathish merged commit 2101ee3e4f into main 2026-08-04 13:18:52 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
pradeep sanjeev sathish siva
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Re-Quest/adminpanel#1
Delete Branch "fix/security-audit"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?