mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-11-10 12:28:28 +00:00
Jamie Curnow
5b7e34eb67
Security - Check advanced_config permissions before creating a certificate on host update (proxy, redirection and 404 hosts). A refused request previously requested a Let's Encrypt certificate first, leaving an orphan certificate and using up rate limit. - Only trust X-NPM-Peer-Addr when it comes with a secret generated at container start. The admin nginx sends both headers. Any proxy host or stream forwarding to 127.0.0.1:3000 was also a loopback peer, so it could forge the header and get a fresh rate-limit bucket on every request. Without the secret (dev, or a mounted production.conf), the header is ignored. - Add a login limit per IP across all accounts (30 failed attempts a minute) alongside the per-account one. Before this, one address could spray passwords over any number of accounts. Behind a shared proxy, everyone using that proxy shares this limit. - Stop trusting X-Real-IP from loopback. It was only there for an older version of the rate limiter, and it let a stream host forwarding to a local proxy host forge the client IP and get past IP access lists. Loopback now behaves as it does on master. Correctness - Refuse to delete a certificate that hosts still use (400, with counts per host type). Their configs include its files, and a successful revoke deleted them anyway, which broke nginx -t. Otherwise the certificate is revoked and its files are removed even if the revoke fails. - Let non-admins clear a location's advanced config. Deleting the location was already allowed and has the same effect, and a location deleted and re-added at the same path arrives with an empty config, which was refused. - Clear proxy host grants (meta.proxy_host_ids) when visibility isn't "user" or proxy hosts are hidden, and drop ids of deleted hosts. Before, hidden grants came back when proxy hosts were shown again. The backend enforces this; the permissions modal also stops sending them. - 404 host and redirection host modals now wait for the current user to load, so an admin's advanced config change isn't dropped if they submit before it loads. Tests - NonAdminHosts.cy.js: refused change doesn't create a certificate, location rename and clear rules, grant clearing. - Certificates.cy.js: deleting a certificate that is in use.
61 lines
1.0 KiB
JSON
61 lines
1.0 KiB
JSON
{
|
|
"operationId": "deleteCertificate",
|
|
"summary": "Delete a Certificate",
|
|
"tags": ["certificates"],
|
|
"security": [
|
|
{
|
|
"bearerAuth": ["certificates.manage"]
|
|
}
|
|
],
|
|
"parameters": [
|
|
{
|
|
"in": "path",
|
|
"name": "certID",
|
|
"description": "Certificate ID",
|
|
"schema": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"required": true,
|
|
"example": 2
|
|
}
|
|
],
|
|
"responses": {
|
|
"200": {
|
|
"description": "200 response",
|
|
"content": {
|
|
"application/json": {
|
|
"examples": {
|
|
"default": {
|
|
"value": true
|
|
}
|
|
},
|
|
"schema": {
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"400": {
|
|
"description": "400 response",
|
|
"content": {
|
|
"application/json": {
|
|
"examples": {
|
|
"default": {
|
|
"value": {
|
|
"error": {
|
|
"code": 400,
|
|
"message": "Certificate is in use by 1 proxy host. Remove it from them before deleting it."
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"schema": {
|
|
"$ref": "../../../../components/error.json"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|