MrMasterbay 965ec2ce6e security(authz): close 2 Aikido code-audit gaps (portal reboot perm + power-rates IDOR) ...

- client_portal _vm_power: reboot was gated on vm.start, so a start-only
  portal user could reboot (stop+start) a guest. Now gates on vm.restart,
  matching the main VM API and the scheduler. (Aikido #469089251)
- api/power.py list_rates (GET /api/power/rates): returned every cluster's
  power/cost rates to any authed user. Now scoped via get_user_clusters
  (admins / default tenant see all), always keeping the shared __default__
  fallback row. (Aikido #469089241)
- tests: tests/test_aikido_batch3.py (5) — scoped vs admin list + the
  reboot/start/shutdown permission mapping.

2026-08-09 20:00:23 +02:00

..

client_portal

security(authz): close 2 Aikido code-audit gaps (portal reboot perm + power-rates IDOR)

2026-08-09 20:00:23 +02:00

hello_world

v0.9.4 — Network View, Light Mode, Security Hardening

2026-03-29 22:17:31 +02:00

notifications

security: re-scan tail — CSRF/http-splitting/CSP, 2 SSRF, SIEM secret masking, power/drift/schedules IDOR

2026-07-13 22:10:56 +02:00

proxmox-ha

Update __init__.py

2026-03-26 22:50:08 +02:00

status_page

security(status): escape unparseable timestamps in status-page fmtTime (CWE-79)

2026-07-21 08:10:10 +02:00

.gitkeep

v0.9.3: plugin system, balancing tolerance, 15 bug fixes, 8 features

2026-03-22 21:38:41 +01:00