Skip to content

Require login for crontab actions#7

Open
Aoody743 wants to merge 1 commit into
mainfrom
codex/fix-unauthenticated-cron-task-vulnerability
Open

Require login for crontab actions#7
Aoody743 wants to merge 1 commit into
mainfrom
codex/fix-unauthenticated-cron-task-vulnerability

Conversation

@Aoody743

Copy link
Copy Markdown
Owner

Motivation

  • The crontab blueprint exposed state-changing and execution endpoints (notably /modify_crond and /start_task) without authentication, enabling unauthenticated modification of cron scripts and remote code execution as the panel user.
  • The change's intent is to block unauthenticated access to all sensitive crontab operations by enforcing the existing panel authentication decorator.

Description

  • Added @panel_login_required to the crontab route handlers for logs, delete, delete-logs, set status, data list, get task, modify task, and start task in web/admin/crontab/__init__.py so these endpoints require authentication.
  • Preserved existing functionality and existing authenticated routes (/index, /list, /add) while only adding the authentication guard to previously unprotected actions.
  • No changes were made to crontab business logic beyond requiring authentication on the affected routes.

Testing

  • Ran python -m py_compile web/admin/crontab/__init__.py which completed successfully and reported no syntax errors.
  • Ran git diff --check which reported no whitespace or diff issues.

Codex Task

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant