mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-11-15 13:18:22 +00:00
Jamie Curnow
04c1f5ae76
Security - Redact certbot output before it reaches the API: strip the certificate's DNS credential values, URL query strings and userinfo, secret-looking key=value pairs and Bearer/Basic tokens. DNS plugins can echo request URLs carrying API keys. The raw CommandError is no longer attached as `previous`, since the error handler returns `previous` to the client on certificate routes. - Rate limit login/2FA on the admin nginx's real TCP peer, passed as X-NPM-Peer-Addr ($realip_remote_addr), instead of X-Forwarded-For. nginx trusts X-Real-IP from private ranges, so a client on the LAN or Docker network could get a fresh bucket on every request. Behind another proxy, limits now apply per account through that proxy. - Bound rate limiter memory: hash keys over 128 chars and cap each store at 50k entries, removing expired entries first and then the oldest. Correctness - Proxy host modal: send location advanced configs unchanged for non-admins instead of looking them up by path, which dropped the config from a renamed location. - Location advanced config: locations that omit advanced_config now get a config only after explicit ones are matched, so a new location at an old path can't take the config from the renamed location. - Certificate upload: check that the certificate matches the private key (uploaded or stored) before writing, so a mismatched pair can't break nginx -t. - Certificate delete: keep the Let's Encrypt files when revoke fails and hosts still use the certificate, so their configs still load. Cleanup - Make the rate-limit certbot hint first in the list, as its comment says. - Proxy host getCount uses the permissions access has already loaded instead of querying user_permission again. - Rate limiter: register the success refund listener in one place and call it a fixed window, not a sliding one.