kzbkowskiandClaude Sonnet 5
b313c126ce
Config backup, a Docker dev/prod split, and a Gitea-built release image.
Added
- /settings -> General -> "Configuration backup": JSON export/import of the
panel's general settings + attribute definitions
(App\Services\ConfigBackupService); audited as config.export / config.import.
Export can leave out the attribute-encryption key. No AD data included.
- docker/compose.dev.yaml: live-reload dev stack that bind-mounts the working
tree. docker/php/Dockerfile is now multi-stage (base -> dev / prod).
- .github/workflows/release.yml: on every vX.Y.Z tag, builds the prod image and
pushes gitea.kzbikowski.pl/kzbkowski/adconsole:{X.Y.Z,X.Y,latest}.
Changed
- docker/compose.yaml: self-contained prod image (app code + composer install
--no-dev baked in via COPY); persistent state in docker/data/{app_storage,db};
defaults to the released image (ADCONSOLE_VERSION pins a tag, ADCONSOLE_IMAGE
replaces the ref). Apache now honours public/.htaccess (AllowOverride All).
Run from the repo root with --env-file .env.
- Repo root now holds only README.md; CHANGELOG / CONTRIBUTING / SECURITY /
CODE_OF_CONDUCT moved under docs/.
Upgrade notes: docs/upgrading.md#v110--docker-layout. Full log: docs/CHANGELOG.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JKT9p3bfP8RZesExdYCS52
2.0 KiB
Security policy
Reporting a vulnerability
Please do not open a public issue for security problems.
Email the maintainer at mail@kzbikowski.pl with the subject prefixed
[ADconsole security]. If the host offers private vulnerability reporting, that
channel is fine too.
Please include:
- affected version / commit
- a description and impact assessment
- reproduction steps or a proof of concept
- any suggested fix
You'll get an acknowledgement within a few working days. Please give a reasonable window for a fix before public disclosure; we'll credit you in the release notes unless you'd rather stay anonymous.
Scope
In scope: authentication and the AD_LOGIN_GROUP gate, authorisation between
modules, LDAP query/filter construction (injection), handling of the service
account credentials, the attribute-encryption feature, session handling, CSRF,
XSS in the Blade views, privilege escalation via the bulk actions.
Out of scope: issues that require a already-privileged panel account performing actions it is legitimately delegated to do in AD; missing hardening that is the operator's responsibility (see below); vulnerabilities in Laravel, LdapRecord or other dependencies (report those upstream — do tell us so we can pin/patch).
Operator responsibilities
ADconsole is a privileged tool. When you deploy it, you are responsible for:
- Serving it over HTTPS only, reachable from admin networks / VPN only.
APP_DEBUG=false,APP_ENV=production.- An encrypted LDAP channel (
LDAP_SSL/LDAP_TLS) and, ideally,LDAP_TLS_VERIFY=true. - Delegating the service account only the AD rights you actually use (active-directory.md).
- Keeping
AD_LOGIN_GROUPsmall and audited. - Protecting
.env(file mode600) — it contains the service-account password. - Applying updates promptly.
See the hardening checklist.
Supported versions
The latest release on main receives security fixes. This is a
community/self-hosted project with no long-term-support branches.