mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
jevb
6eba999233
Server: - Add Let's Encrypt (ACME) TLS mode with autocert, HTTP-01 challenges on :80, and automatic certificate renewal (tls.mode: "acme" in config.yaml) - Add ASCII art startup banner with server info and endpoint URLs - Fix CSP blocking admin panel inline styles/scripts (per-route override) - Suppress TLS handshake error noise in console output - Fix TOCTOU race in invite consumption (atomic UPDATE with row-count check) - Fix sendMsg mutex race condition (hold lock for entire send) - Fix permission override formula (deny-first, allow-wins) - Fix voice join parsing channelID before permission check - Add session expiry check at WebSocket auth and periodic revalidation - Add message length limit (4000 chars) and emoji length validation (32 bytes) - Add file size enforcement in storage after io.Copy - Add checksum URL validation in updater - Add backup path traversal protection (BackupToSafe) - Add self-modification guard in admin handlePatchUser - Fix admin ownerOnlyMiddleware to use context user instead of re-auth - Remove redundant startup log lines (banner shows same info) - Add periodic expired session cleanup (15-min ticker) - Add permissions package with bitfield constants and EffectivePerms - Add rate limiter cleanup goroutine to prevent unbounded growth - Add auth helpers (IsEffectivelyBanned, IsSessionExpired) - Add WebSocket origin validation Client: - Add TOFU certificate trust service - Add receive loop error handling - Fix redundant else-if in OnChatMessage
30 lines
955 B
Go
30 lines
955 B
Go
package ws
|
|
|
|
import "nhooyr.io/websocket"
|
|
|
|
// OriginAcceptOptions builds a *websocket.AcceptOptions that enforces origin
|
|
// checking according to the provided allowed-origins list.
|
|
//
|
|
// Rules:
|
|
// - nil or empty list → InsecureSkipVerify = true (same as the old default)
|
|
// - list contains "*" → InsecureSkipVerify = true (explicit opt-in)
|
|
// - any other list → OriginPatterns set to the list; origin checking active
|
|
//
|
|
// The wildcard cases preserve backward compatibility: if a deployment has not
|
|
// set allowed_origins the server continues to work exactly as before.
|
|
func OriginAcceptOptions(allowedOrigins []string) *websocket.AcceptOptions {
|
|
if len(allowedOrigins) == 0 {
|
|
return &websocket.AcceptOptions{InsecureSkipVerify: true}
|
|
}
|
|
|
|
for _, o := range allowedOrigins {
|
|
if o == "*" {
|
|
return &websocket.AcceptOptions{InsecureSkipVerify: true}
|
|
}
|
|
}
|
|
|
|
return &websocket.AcceptOptions{
|
|
OriginPatterns: allowedOrigins,
|
|
}
|
|
}
|