2 Commits

Include renames

Author	SHA1	Message	Date
fen	d013f3965f	Require secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141) ... Query strings leak into Traefik access logs, browser history, and Referer headers. Admin key is now accepted only via X-Admin-Key; paste and can passwords only via X-Paste-Password (or the POST unlock form). Tests updated; new negative cases assert 401 for the query paths.	2026-09-09 23:23:10 -05:00
fen	99a044e8a2	Rate-limit all password verification attempts (#81) ... GET ?password= and X-Paste-Password header checks in handleGetPaste were unlimited (pentest2: 8 wrong = 8x401, no 429). Gate every password verification on the same per-IP+paste unlock limiter (5/min, 429 with Retry-After) already used by the POST unlock form path. Regression tests: repeated wrong passwords via GET ?password= and via header must eventually 429; correct password within burst still 200. Fixes #81	2026-09-09 10:58:21 -05:00