mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-09-13 05:47:23 -04:00
objecttothis
61bb1a2c2a
* fix(auth): hash throttler keys to improve security - Use MD5 hashing for IP and username-based throttler keys to obfuscate sensitive data while maintaining functionality. * test(auth): add IPv6 throttling test and hash used throttler keys - Add a test to ensure throttling works correctly with IPv6 addresses. - Update throttler keys to use MD5 hashes for IPs and usernames for improved security and consistency. * fix(auth): handle non-scalar usernames in throttler keys - Ensure username input is validated as scalar before processing to prevent errors and maintain throttling logic integrity. * fix(auth): enhance throttler key security with HMAC hashing - Replace MD5 with HMAC-SHA256 for generating throttler keys. - Include encryption key from app configuration for added security. * test(filters): update ThrottleTest to use HMAC-SHA256 for throttler keys - Replace MD5 with HMAC-SHA256 for generating throttler keys in tests. - Introduce `check_encryption()` to ensure encryption configuration is available. * fix(events): validate encryption key on app initialization - Throw ConfigException if encryption key is missing or invalid during `pre_system` event. - Remove redundant `check_encryption()` call from Throttle filter and tests. * fix(events): improve encryption key validation in `pre_system` - Add `check_encryption()` helper call for additional security verification. - Update error message to highlight `.env` writability issues if the key is invalid. * test(filters): handle non-scalar usernames in ThrottleTest - Update `makeRequest` to validate usernames as scalar and cast them to strings before processing. - Add a test to ensure array usernames are ignored, and throttling is applied only based on IP. - Improve status code assertions for throttled requests. --------- Signed-off-by: objecttothis <17935339+objecttothis@users.noreply.github.com>