steggi/pyramid
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 9 Wiki Activity

security: Admin-Token aus Client entfernen (E2EE-Diagnose entkoppeln)

Browse Source 
Der Dashboard-Server benutzte fuer /api/e2ee-diagnostics denselben String
wie den Matrix-Admin-Token, weshalb der Client den vollen Server-Admin-Token
einbetten musste (jeder Nutzer, auch Uta, trug ihn im Geraet).

- server.py (Pi): eigener, eng begrenzter DIAG_TOKEN statt Admin-TOKEN
- settings_encryption.dart: benutzt den neuen Diagnose-Token
- grep J5lax lib/ jetzt leer; Endpoint verifiziert (neu 200, alt 403)

Admin-Token-Rotation bleibt offen (Bernds Sache, ROADMAP M0).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Bernd Steckmeister
2026-07-04 04:04:15 +02:00
parent fe6427bfba
commit 925aafb2fe
4 changed files with 62 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGES.md
+4
View File
@@ -1224,3 +1224,7 @@
2026-07-04 03:31 [Edit] /home/steggi/pyramid/PROGRESS.md
2026-07-04 03:32 [Edit] /home/steggi/pyramid/PROGRESS.md
2026-07-04 03:32 [Edit] /home/steggi/pyramid/ROADMAP.md
2026-07-04 04:01 [Edit] /home/steggi/matrix/server.py
2026-07-04 04:02 [Edit] /home/steggi/pyramid/lib/widgets/settings/settings_encryption.dart
2026-07-04 04:03 [Edit] /home/steggi/pyramid/ROADMAP.md
2026-07-04 04:03 [Edit] /home/steggi/pyramid/PROGRESS.md