Mirrors/sftpgo
1
0
Fork 0
mirror of https://github.com/drakkan/sftpgo.git synced 2025-12-07 14:50:55 +03:00
Code Issues Packages Projects Releases Wiki Activity
2,259 Commits 9 Branches 53 Tags
317f14f86992ae6b096c9e25b5efffc35e877f9f
Commit Graph

34 Commits

Author SHA1 Message Date
Nicola Murino
0ae2354fed JWT: replace jwtauth/jwx with lightweight wrapper around go-jose 
We replaced the jwtauth and jwx libraries with a minimal custom wrapper
around go-jose because we don’t need the full feature set provided by jwx.
Implementing our own wrapper simplifies the codebase and improves
maintainability.

Moreover, go-jose depends only on the standard library, resulting in a
leaner dependency that still meets all our requirements.

This change also reduces the SFTPGo binary size by approximately 1MB

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2025-10-08 18:10:39 +02:00
Nicola Murino
a5dd529d88 node token: embed permissions directly in JWT 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2025-08-22 15:57:41 +02:00
Nicola Murino
d95d773570 oidc: allow login if the password method is disabled 
isLoggedInWithOIDC returns false before login so we need to add
a specific check

Fixes #1879

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2025-03-29 20:28:49 +01:00
Nicola Murino
f096675a2b fix log formatting 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2025-03-12 11:19:38 +01:00
Nicola Murino
e21c989038 logs: add a specific log structure for successful logins 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2024-12-07 10:29:33 +01:00
Nicola Murino
d3e76898cd WebAdmin: refactor template permissions 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2024-11-26 20:39:36 +01:00
Nicola Murino
433d45ed87 WebUI: add a token validation mode that allows checking the signature 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2024-09-21 14:06:25 +02:00
Nicola Murino
6896d2bfb1 httpd: validate reference also for CSRF token in headers 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2024-09-14 21:45:25 +02:00
Nicola Murino
fa710b36c2 httpd: allow to configure cache control header 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2024-08-12 21:19:44 +02:00
Nicola Murino
d94f80c8da replace utils.Contains with slices.Contains 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2024-07-24 18:27:13 +02:00
Nicola Murino
d650defa08 remove duplicated jwt tokens validation 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2024-06-15 16:19:37 +02:00
Nicola Murino
8294952474 WebUIs: refactor CSRF 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2024-06-14 18:09:32 +02:00
Nicola Murino
50a3c0d911 defender: allow to impose a delay between login attempts 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2024-05-18 10:35:54 +02:00
Nicola Murino
de089e51fd Web: allow to require password change and two-factor for admins 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2024-02-21 20:45:10 +01:00
Nicola Murino
91802fad3e WIP new WebAdmin: profile, change password, message pages 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2024-01-18 19:18:57 +01:00
Nicola Murino
784b7585c1 remove end year from Copyright notice in files 
so we don't have to update all the files every year

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2024-01-01 11:31:45 +01:00
Nicola Murino
61fe7c39a7 WebClient: allow to pass args for localized errors from the backend 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2023-12-12 18:04:14 +01:00
Nicola Murino
c71f0426ae WebClient WIP: add support for localizations 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2023-12-10 16:40:13 +01:00
Nicola Murino
87b12af932 static files: refactor neutered http.FileSystem 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2023-11-03 17:22:28 +01:00
Nicola Murino
ba9df51b2e fix or suppress lint warnings detected by golangci-lint 1.55.0 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2023-10-20 20:31:17 +02:00
Nicola Murino
fac022090d httpd: disable directory index for static files 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2023-09-08 19:55:45 +02:00
Nicola Murino
aefcea034a validate API key scope 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2023-09-08 18:54:11 +02:00
Nicola Murino
9d60972743 WebClient: redirect to the requested URL after login 
This feature is only useful and enabled for file manager urls

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2023-06-08 18:14:47 +02:00
Nicola Murino
0423e8f157 httpd: generate defender events for failed 2fa and password resets 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2023-03-04 13:55:48 +01:00
Nicola Murino
dba088daed printf: replace %#v with the more explicit %q 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2023-02-27 19:19:57 +01:00
Nicola Murino
7e85356325 WebClient shares: replace basic auth with a login form 
basic auth will continue to work for REST API

Fixes #1166

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2023-02-12 08:29:53 +01:00
Nicola Murino
0190d0b849 update Copyright year 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2023-01-03 10:18:30 +01:00
Nicola Murino
147ad3b230 respect token validation mode for CSRF header 
Fixes #1104

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2022-12-16 19:14:56 +01:00
Nicola Murino
ad5d657a1a add support for password policies 
you can now set a password expiration and the password change requirement

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2022-12-11 17:15:34 +01:00
Nicola Murino
1f9cf194fe add role to events 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2022-12-03 11:45:27 +01:00
Nicola Murino
5a222807b7 add roles 
Fixes #837

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2022-11-16 19:04:50 +01:00
Nicola Murino
2636fedce8 node token: add/pars admin username 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2022-10-02 09:51:47 +02:00
Nicola Murino
76e89d07d4 add support for inter-node communications 
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2022-09-25 19:48:55 +02:00
Nicola Murino
c8158e14e0 move SFTPGo package to the internal folder 
SFTPGo is a daemon and command line tool, not a library.

The public API are provided by the SDK

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
 2022-07-24 16:18:54 +02:00