starred/nginx-proxy-manager
1
0
Fork 0
mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-09-24 18:50:17 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity
2,534 Commits 13 Branches 89 Tags
1ffe3609f41fd3ff9bd3462e480f105dc917d676
Commit Graph
2534 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
José M. Requena Plens 1ffe3609f4 Invalidate tokens issued before a password change 
Tokens are stateless JWTs, so changing a password left every session that
the old one had opened working until its own expiry, up to a day later.
That is the case the password change is meant to close: an administrator
resetting a compromised account did not evict whoever was already in it.

The auth row already records when the password last changed, so no
migration is needed: `Access.init()` reads it alongside the user it
already loads and refuses a token whose `iat` is older. Both sides are
compared as whole seconds, which is all `iat` carries, so a token minted
in the same second as the change is kept. Postgres stores that column to
the microsecond, which is why the comparison is not done in milliseconds.

It is reported as 401 rather than the usual 403 because that is what the
frontend clears the session on, so the browser holding the dead token
lands on the login page instead of a page full of errors, and `can()`
lets that one error through unwrapped for the same reason.

Only the password does this. A user row changing (a rename, an avatar,
permissions) does not, and a user with no password auth row, which is
what a login through an external provider looks like, is not affected.
 2026-09-06 19:48:02 +02:00
jc21 a2d427902a Merge pull request #5828 from NginxProxyManager/dependabot/npm_and_yarn/backend/fast-uri-3.1.7 
Bump fast-uri from 3.1.5 to 3.1.7 in /backend
 2026-09-04 07:42:57 +10:00
dependabot[bot] ebbd262e06 Bump fast-uri from 3.1.5 to 3.1.7 in /backend 
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.5 to 3.1.7.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.5...v3.1.7)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-02 22:41:08 +00:00
jc21 5e6c53f0e2 Merge pull request #5726 from NginxProxyManager/dependabot/npm_and_yarn/test/axios-1.18.0 
Bump axios from 1.19.0 to 1.20.0 in /test
 2026-09-01 07:10:25 +10:00
jc21 baa5683bba Merge pull request #5823 from NginxProxyManager/dependabot/npm_and_yarn/backend/prod-minor-updates-1a71c66db8 
Bump mysql2 from 3.23.4 to 3.24.2 in /backend in the prod-minor-updates group
 2026-09-01 07:10:12 +10:00
jc21 386a166025 Merge pull request #5820 from NginxProxyManager/dependabot/npm_and_yarn/test/cypress/grep-7.0.0 
Bump @cypress/grep from 6.0.3 to 7.0.0 in /test
 2026-09-01 07:09:32 +10:00
dependabot[bot] f7a696cf08 Bump mysql2 in /backend in the prod-minor-updates group 
Bumps the prod-minor-updates group in /backend with 1 update: [mysql2](https://github.com/sidorares/node-mysql2).


Updates `mysql2` from 3.23.4 to 3.24.2
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](https://github.com/sidorares/node-mysql2/compare/v3.23.4...v3.24.2)

---
updated-dependencies:
- dependency-name: mysql2
  dependency-version: 3.24.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-31 13:04:27 +00:00
dependabot[bot] ec65105db2 Bump @cypress/grep from 6.0.3 to 7.0.0 in /test 
Bumps [@cypress/grep](https://github.com/cypress-io/cypress) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/cypress-io/cypress/releases)
- [Changelog](https://github.com/cypress-io/cypress/blob/develop/CHANGELOG.md)
- [Commits](https://github.com/cypress-io/cypress/compare/@cypress/grep-v6.0.3...@cypress/grep-v7.0.0)

---
updated-dependencies:
- dependency-name: "@cypress/grep"
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-31 13:04:01 +00:00
dependabot[bot] aa211ea423 Bump axios from 1.19.0 to 1.20.0 in /test 
Bumps [axios](https://github.com/axios/axios) from 1.19.0 to 1.20.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.19.0...v1.20.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.18.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-31 10:43:00 +00:00
jc21 cd4448ebef Merge pull request #5713 from NginxProxyManager/dependabot/npm_and_yarn/test/systeminformation-5.31.17 
Bump systeminformation from 5.31.6 to 5.31.17 in /test
 2026-08-31 20:41:29 +10:00
jc21 e2546bfb51 Merge pull request #5737 from NginxProxyManager/dependabot/npm_and_yarn/frontend/immutable-5.1.9 
Bump immutable from 5.1.5 to 5.1.9 in /frontend
 2026-08-31 20:40:55 +10:00
jc21 c19182d978 Merge pull request #5743 from NginxProxyManager/dependabot/npm_and_yarn/test/tar-7.5.22 
Bump tar from 7.5.15 to 7.5.22 in /test
 2026-08-31 20:40:38 +10:00
jc21 1cbfe370ec Merge pull request #5756 from NginxProxyManager/dependabot/npm_and_yarn/docs/postcss-8.5.25 
Bump postcss from 8.5.14 to 8.5.25 in /docs
 2026-08-31 20:40:25 +10:00
jc21 6c2a57ad83 Merge pull request #5769 from NginxProxyManager/dependabot/npm_and_yarn/test/fast-uri-3.1.5 
Bump fast-uri from 3.1.2 to 3.1.6 in /test
 2026-08-31 20:40:10 +10:00
jc21 b75b0adaf2 Merge pull request #5812 from vzagorovskiy/fix/keep-failed-nginx-config-as-err 
Keep the failed nginx config as a .conf.err file
 2026-08-29 10:14:42 +10:00
vzagorovskiy a570c0e503 Keep the failed nginx config as a .conf.err file 
When `nginx -t` fails, configure() is meant to move the broken config to
<id>.conf.err so the failure can be inspected. renameConfigAsError()
unlinked the source file before renaming it, so the rename always failed
and the config was simply deleted. The deleteConfig() call after it then
removed any .err file left over from an earlier failure.

- unlink the destination .err file instead of the source
- return the rename promise so the delete does not race it
- pass delete_err_file = false so the new .err file survives
- drop the stale 4th argument in the success path, which silently made
  delete_err_file false and left old .err files behind
 2026-08-28 11:47:02 +03:00
jc21 6383017b4c Merge pull request #5780 from NginxProxyManager/dependabot/npm_and_yarn/test/js-yaml-4.3.1 
Bump js-yaml from 4.1.1 to 4.3.1 in /test
 2026-08-28 16:29:35 +10:00
jc21 3f2cd26913 Merge pull request #5789 from quokkawiki/develop 
Fixed Estonian flag bug
 2026-08-28 14:16:55 +10:00
jc21 ece5dea0ad Merge branch 'develop' into develop 2026-08-28 07:57:25 +10:00
jc21 a75eb467ca Merge pull request #5807 from vgoer/changes-not-taking-effect 
fix: Changes not taking effect
 2026-08-28 07:51:55 +10:00
jc21 708ea5cfbb Merge pull request #5809 from tapacko88/feat/ukrainian-locale 
Add Ukrainian locale
 2026-08-28 07:50:51 +10:00
tapacko d77d5c643d Add Ukrainian locale 2026-08-26 23:39:25 +01:00
jc21 934a3fafe5 Merge pull request #5765 from fatihemre/feat/collapsible-custom-locations 
Collapse custom locations into a filterable list
 2026-08-27 07:42:43 +10:00
vgoer 08b4bbdbd4 fix: Changes not taking effect 2026-08-26 07:39:31 +00:00
jc21 a7677c18c3 Merge branch 'develop' into feat/collapsible-custom-locations 2026-08-26 13:00:05 +10:00
dependabot[bot] 1d894f8ed1 Bump fast-uri from 3.1.2 to 3.1.6 in /test 
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.6.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.6)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-26 02:59:09 +00:00
dependabot[bot] 7cde02c446 Bump js-yaml from 4.1.1 to 4.3.1 in /test 
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.3.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/4.1.1...4.3.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-26 02:59:07 +00:00
jc21 190b7a606d Merge pull request #5763 from NginxProxyManager/dependabot/github_actions/actions/stale-11 
Bump actions/stale from 10 to 11
 2026-08-26 12:57:43 +10:00
jc21 61e74cbb7f Merge pull request #5773 from zergflag/develop 
Add LWS DNS provider
 2026-08-26 12:57:00 +10:00
Jamie Curnow ba8117fbcf Update test deps 2026-08-26 12:56:32 +10:00
jc21 5e7fea7d56 Merge pull request #5787 from CallMeLeon167/develop 
Add German translations for two-factor authentication and some UI elements
 2026-08-26 12:54:23 +10:00
jc21 4f1d309a90 Merge pull request #5788 from setrin/fix/update-websupport-certbot-plugin 
fix(certbot): update Websupport DNS plugin to 5.0.0
 2026-08-26 12:52:52 +10:00
jc21 58ff491dc0 Merge pull request #5795 from xzy103/fix/tencentcloud-dns-apex-wildcard 
Fix Tencent Cloud apex and wildcard certificate issuance
 2026-08-26 12:52:00 +10:00
jc21 85ee5e2200 Merge pull request #5800 from frenck/fix/update-timeweb-certbot-plugin 
fix(certbot): update Timeweb Cloud DNS plugin to 2.0.0
 2026-08-26 12:50:39 +10:00
Jamie Curnow 09300941af Add white padding to qrcode, especially in dark mode 2026-08-26 12:48:36 +10:00
jc21 c4fa8daa87 Merge pull request #5801 from vgoer/qr-services-2FA 
Switched to local QR code generation to prevent leaking 2FA keys to third-party QR services.
 2026-08-26 12:47:56 +10:00
jc21 3d800c7138 Merge branch 'develop' into qr-services-2FA 2026-08-26 08:07:11 +10:00
Jamie Curnow 2ed0c47de8 Fix #5802 404 hosts disable missing async/await paradigm 2026-08-26 08:02:52 +10:00
vgoer 4d30946d2f fix: local QR code 2026-08-25 09:14:44 +00:00
vgoer a5e49a53c0 feat: Add react-qr-code dependency 2026-08-25 09:13:41 +00:00
Franck Nijhof 41539c027f fix(certbot): update Timeweb Cloud DNS plugin to 2.0.0 2026-08-25 10:15:38 +02:00
jc21 046d3e022f Merge pull request #5798 from vgoer/develop 
Fix: Insufficient private key permissions led to a leak and  Effective fixing when setting PUID and PGid environment variables
 2026-08-25 07:41:27 +10:00
vgoer c98b1685bd Merge pull request #1 from vgoer/private-key-permissions 
Insufficient private key permissions led to a leak.
 2026-08-24 17:49:40 +08:00
vgoer b7772016ba fix: Ensure JWT key file ownership matches PUID/PGID at startup 2026-08-24 09:30:36 +00:00
vgoer 29687987b2 fix: Restrict JWT key file permissions to 0600 2026-08-24 09:30:22 +00:00
jc21 ab893706da Merge pull request #5796 from timothestoifl24/claude/nifty-neumann-83e87c 
Fix missing `new` on PermissionError so denied requests return 403, not 404
 2026-08-23 00:11:02 +10:00
Timothé Stoifl 246c54503e Merge branch 'develop' into claude/nifty-neumann-83e87c 2026-08-22 15:40:15 +02:00
Jamie Curnow 4ecb047299 Update frontend packages 
- Major update for react-table
- Fix Hosts menu staying around after selecting a menu item
 2026-08-22 23:23:20 +10:00
Jamie Curnow 4e2b052b50 Updated backend packages 2026-08-22 23:10:26 +10:00
Timothé Stoifl ce4e35a3d4 Fix missing new on PermissionError in access.can() 
The catch block in `access.can()` constructed `errs.PermissionError`
without `new`. The error constructors in `backend/lib/error.js` are plain
constructor functions that assign to `this` and return nothing, so calling
one without `new` evaluates to `undefined`.

The statement therefore did `throw undefined`, the express error handler
in `backend/app.js` received undefined (and could not read `.status` or
`.public` off it), and the request fell through to the catch-all 404
handler in `backend/routes/main.js`.

Net effect: every authorization failure raised by `access.can(...)` was
reported to clients as `404 Not Found` instead of `403 Forbidden`.

Line 45 of the same file already used `new` correctly, which shows this
was an oversight rather than deliberate resource-existence hiding. A grep
over `backend/` confirms this was the only error constructor invoked
without `new`.
 2026-08-22 13:07:09 +02:00