Query strings land in Traefik access logs, browser history, and Referer headers, so accepting the admin key (?key=) or paste passwords (?password=) there leaked the secrets to anyone with log access.
adminKeyOK now accepts the key only via X-Admin-Key
GET paste/can/items accept the password only via X-Paste-Password (POST unlock form unchanged)
Tests updated; new negative cases assert 401 for the query paths
go vet + go test green; behavior verified live: query 401, header 200
Fixes #137, fixes #141
Query strings land in Traefik access logs, browser history, and Referer headers, so accepting the admin key (?key=) or paste passwords (?password=) there leaked the secrets to anyone with log access.
- adminKeyOK now accepts the key only via X-Admin-Key
- GET paste/can/items accept the password only via X-Paste-Password (POST unlock form unchanged)
- Tests updated; new negative cases assert 401 for the query paths
- go vet + go test green; behavior verified live: query 401, header 200
Query strings leak into Traefik access logs, browser history, and Referer
headers. Admin key is now accepted only via X-Admin-Key; paste and can
passwords only via X-Paste-Password (or the POST unlock form). Tests
updated; new negative cases assert 401 for the query paths.
fen
merged commit d44e4d1587 into dev2026-09-10 04:23:27 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #137, fixes #141
Query strings land in Traefik access logs, browser history, and Referer headers, so accepting the admin key (?key=) or paste passwords (?password=) there leaked the secrets to anyone with log access.