Commit graph

7 commits

Author SHA1 Message Date
Alfredo Cardigliano
669589fe20 Fix missing authorization check in edit_blacklist.lua REST endpoint
Any authenticated user, including unprivileged accounts, could modify
threat intelligence blacklist URLs, enable/disable status, and update
intervals via POST /lua/rest/v2/edit/system/edit_blacklist.lua. Add
the same isAdministrator() guard used by the sibling
edit/category/category.lua endpoint.

GHSA-ffg5-889g-f5q8

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-16 14:53:27 +02:00
Luca Deri
389e832d1c (C) update 2026-01-19 16:23:53 +01:00
Nicolo Maio
2e1b64d760 Add Blacklist reset button (#8359) 2024-05-03 15:01:50 +02:00
Matteo Biscosi
0fecdee1e4 Reworked blacklists page 2024-04-11 12:48:59 -04:00
Alfredo Cardigliano
5623b9c6f7 Remove system endpoint 2022-02-23 14:53:48 +01:00
Alfredo Cardigliano
257ece18c0 Copyright update (Lua) 2022-01-03 09:42:33 +01:00
Simone Mainardi
b117e8a23a Adds new REST API v2/
Addresses #5269
2021-07-08 09:57:46 +02:00