Commit Graph

  • 5c695f66c8
    Merge 5cfdb2db6d into 7ed527cdff alespour 2026-03-26 16:42:38 +0000
  • 5cfdb2db6d fix: return specific Flux guard errors for 400/403/413 cases fix/issue-1042 Ales Pour 2026-03-26 17:42:23 +0100
  • d799e82cd8 fix: return 413 for oversized InfluxQL request bodies Ales Pour 2026-03-26 17:35:16 +0100
  • 36414f0748
    Merge d01989f446 into 7ed527cdff alespour 2026-03-26 17:30:23 +0100
  • d01989f446 test(oauth2): cover secure cookie flag in NewCookieJWT fix/issue-1041 Ales Pour 2026-03-26 17:30:15 +0100
  • e7d0106611 test(e2e): simplify reader flux deny test to assert 403 only Ales Pour 2026-03-26 17:06:35 +0100
  • 4484f320e6 test(e2e): send session cookie in reader flux deny request and assert exact error Ales Pour 2026-03-26 15:03:08 +0100
  • e84d81aaa9 test(e2e): make reader flux deny assertion strict with auth precheck Ales Pour 2026-03-26 14:46:44 +0100
  • b3986e0745 test(e2e): add reader deny coverage for blocked routes and flux proxy path Ales Pour 2026-03-26 14:23:43 +0100
  • e8ebc89dda refactor: colocate flux body-limit helper with flux guard Ales Pour 2026-03-26 14:07:58 +0100
  • 8b43cbebc4 test: remove redundant default flux path in reader guard table Ales Pour 2026-03-26 13:59:39 +0100
  • 64b67cc895 perf(security): use MaxBytesReader for reader InfluxQL request limits Ales Pour 2026-03-26 13:21:37 +0100
  • 76262e5b82 fix(security): restrict reader Flux proxy to /api/v2/query with non-empty query Ales Pour 2026-03-26 13:17:53 +0100
  • 0593aaf9e0 fix(server): preserve request body close semantics in body-limit helper Ales Pour 2026-03-26 12:47:21 +0100
  • 0398ca65f4 fix: add shared reader body size limits and table-driven guard tests Ales Pour 2026-03-26 12:03:04 +0100
  • 4f0da8c3d5 fix: return 400 for reader InfluxQL parse errors Ales Pour 2026-03-26 11:51:48 +0100
  • 0230b2e1d4
    fix: make SPA accept-header check case-insensitive alespour 2026-03-26 11:42:34 +0100
  • 889eb9da05
    fix(ui): tighten reader dashboards route prefix check alespour 2026-03-26 11:36:46 +0100
  • 89c17df680 fix(security): allow reader USE+SELECT while keeping InfluxQL read-only guard Ales Pour 2026-03-26 11:01:50 +0100
  • 2b70f93d05 fix(security): deny unparseable reader Flux request bodies Ales Pour 2026-03-26 10:54:38 +0100
  • 0a8d0452c6 fix(ui): replace inline Redirect with imperative unauthorized redirect Ales Pour 2026-03-26 10:38:16 +0100
  • 7ed527cdff
    chore(deps): bump yaml from 1.10.2 to 1.10.3 (#6192) master dependabot[bot] 2026-03-26 09:46:57 +0100
  • f1788c067c
    chore(deps): bump picomatch from 2.3.1 to 2.3.2 (#6193) dependabot[bot] 2026-03-26 09:46:10 +0100
  • ca71e508aa
    chore(deps): bump picomatch from 2.3.1 to 2.3.2 dependabot[bot] 2026-03-25 22:27:12 +0000
  • 2994e6c920
    chore(deps): bump yaml from 1.10.2 to 1.10.3 dependabot[bot] 2026-03-25 20:22:56 +0000
  • 6037c5228e fix(auth): allow /landing through reader SPA route guard Ales Pour 2026-03-25 16:59:09 +0100
  • ba1b31b6c6 fix(ui): satisfy RedirectProps typing Ales Pour 2026-03-25 16:41:38 +0100
  • 031c9efeb0 style: formatting Ales Pour 2026-03-25 16:11:18 +0100
  • 4735bc0279 feat(auth): enforce reader SPA route allowlist on server Ales Pour 2026-03-25 14:29:31 +0100
  • 44b18677f8 refactor: : extract principal user resolution into shared helper Ales Pour 2026-03-25 14:23:13 +0100
  • 2412cf8ba1 docs: document enforced read-only behavior for reader role Ales Pour 2026-03-25 13:14:04 +0100
  • c32b58e936 fix(security): block Flux to() calls for reader role Ales Pour 2026-03-25 13:06:08 +0100
  • d835a01ad7 fix(security): restrict reader InfluxQL to SELECT/SHOW on query endpoints Ales Pour 2026-03-25 13:05:24 +0100
  • 40a8ac9e76 fix(security): restrict reader InfluxQL to SELECT/SHOW on query endpoints Ales Pour 2026-03-25 12:41:26 +0100
  • 8a3aad3e2d fix(security): restrict reader UI routes to dashboards only Ales Pour 2026-03-25 12:19:48 +0100
  • d05d1b4716
    chore(deps): bump flatted from 3.4.1 to 3.4.2 (#6190) dependabot[bot] 2026-03-23 12:32:59 +0100
  • 7602f9033e
    chore(deps): bump flatted from 3.4.1 to 3.4.2 dependabot[bot] 2026-03-21 20:13:40 +0000
  • e20839d4dc feat: wip NguyenHoangSon96 2026-03-19 15:05:10 +0700
  • c3a68c3fb9
    chore(deps): bump google.golang.org/grpc from 1.71.0 to 1.79.3 (#6187) dependabot[bot] 2026-03-19 05:31:25 +0100
  • 11a4e855a8
    chore(deps): bump google.golang.org/grpc from 1.71.0 to 1.79.3 dependabot[bot] 2026-03-19 02:03:43 +0000
  • ea3e1c64be style: formatting Ales Pour 2026-03-18 11:23:54 +0100
  • c14a0b360e style: go fmt Ales Pour 2026-03-18 11:15:14 +0100
  • f4dc2b4d82 test: fix regexp Ales Pour 2026-03-18 11:15:02 +0100
  • ec44334e28 refactor(ui): remove unused withRouter from DataExplorer Ales Pour 2026-03-18 09:55:41 +0100
  • 1ed2913095 fix: secure cookies Ales Pour 2026-03-18 09:52:20 +0100
  • 1f468aa4f8 fix: same origin also compares scheme and port Ales Pour 2026-03-18 09:06:14 +0100
  • 2ac02d117a
    test: use oauth2.DefaultCookieName in same-origin middleware tests alespour 2026-03-18 09:10:36 +0100
  • 0a79a280a9
    fix: ensure security headers are set on blocked same-origin requests alespour 2026-03-18 09:08:21 +0100
  • 96fe10b8b4
    fix: force X-Requested-With header in AJAX requests alespour 2026-03-18 08:59:00 +0100
  • 39e85228e1 docs: update CHANGELOG Ales Pour 2026-03-18 08:22:55 +0100
  • 3e80203ce3 test(e2e): fix flaky DB name check in explore_influxql Ales Pour 2026-03-18 07:42:13 +0100
  • 38ea6f7666 test(e2e): inject same-origin headers into unsafe cy.request calls Ales Pour 2026-03-18 06:55:25 +0100
  • 7ebbfda702 fix: require XMLHttpRequest header for flux proxy GET Ales Pour 2026-03-17 16:48:07 +0100
  • d75e19bcde fix: add missing files Ales Pour 2026-03-17 11:20:26 +0100
  • d11e009260 fix: enforce same-origin on unsafe session-authenticated requests Ales Pour 2026-03-17 11:17:40 +0100
  • 5523856904 fix: add SAMEORIGIN and CORP response headers Ales Pour 2026-03-17 10:55:16 +0100
  • 8350c4baa2 fix: require XMLHttpRequest header on query execution endpoints Ales Pour 2026-03-17 10:52:48 +0100
  • c9cd31d0ab fix: cookie hardening Ales Pour 2026-03-17 10:38:25 +0100
  • 67c52c590a fix: disable data explorer query/script execution from URL params Ales Pour 2026-03-17 10:29:23 +0100
  • 6af9971084
    chore(deps): bump flatted from 3.3.3 to 3.4.1 (#6185) dependabot[bot] 2026-03-16 07:53:25 +0100
  • 553650d961
    chore(deps): bump flatted from 3.3.3 to 3.4.1 dependabot[bot] 2026-03-15 00:16:37 +0000
  • f338238547
    Merge b8327a080d into 8540b0037f karel-rehor 2026-03-05 14:10:58 +0000
  • b8327a080d chore: update go.sum chore/upgrade-go-1.25.7 karel rehor 2026-03-05 15:10:48 +0100
  • be24fe3f2c chore: revert go.sum karel rehor 2026-03-05 15:04:31 +0100
  • 15ba816372 chore: fix up linker for rust builds of darwin arm64 karel rehor 2026-03-05 14:44:46 +0100
  • 8540b0037f
    chore(deps): bump immutable from 4.0.0 to 4.3.8 (#6183) dependabot[bot] 2026-03-05 07:19:50 +0100
  • a64ab11c08
    chore(deps): bump svgo from 2.8.0 to 2.8.2 (#6184) dependabot[bot] 2026-03-05 07:18:47 +0100
  • 1bf2f88ccb
    chore(deps): bump svgo from 2.8.0 to 2.8.2 dependabot[bot] 2026-03-05 00:54:36 +0000
  • 233b3f05f7
    chore(deps): bump immutable from 4.0.0 to 4.3.8 dependabot[bot] 2026-03-05 00:24:59 +0000
  • 2cce766bb5 chore: choose correct clang compiler for darwin arm karel rehor 2026-03-03 14:38:02 +0100
  • 33ae2fce27 chore: remove toolchain from go.mod karel rehor 2026-03-03 13:22:30 +0100
  • 231f6faed5 chore: restore darwin arm64 build karel rehor 2026-03-03 13:01:40 +0100
  • b57f102488 chore: upgrade library boto to boto3 in build.py karel rehor 2026-03-02 14:44:05 +0100
  • 0f5e601572
    chore(deps): bump minimatch from 3.1.2 to 3.1.5 (#6182) dependabot[bot] 2026-03-02 07:08:55 +0100
  • 7b72cf21f3
    chore(deps): bump minimatch from 3.1.2 to 3.1.5 dependabot[bot] 2026-03-01 08:28:03 +0000
  • 8aa0ce0afa docs: update CHANGELOG.md karel rehor 2026-02-26 17:22:40 +0100
  • 612cf87d09 chore: update go to 1.25.7 in CI config files. karel rehor 2026-02-26 16:28:43 +0100
  • 582293fbd4 chore: update go in go.mod to 1.25.7 karel rehor 2026-02-26 15:17:49 +0100
  • 0019fc6452 chore: update etc/build.py to enforce dynamic darwin builds. karel rehor 2026-02-26 13:55:57 +0100
  • c9494a0134
    chore(deps): bump minimatch from 3.1.2 to 3.1.4 dependabot[bot] 2026-02-25 07:56:42 +0000
  • c265f17e37
    chore(deps): bump minimatch from 3.1.2 to 3.1.3 dependabot[bot] 2026-02-24 22:58:44 +0000
  • 18aa9bdda0
    chore(deps): bump ajv from 6.12.6 to 6.14.0 (#6178) dependabot[bot] 2026-02-23 06:27:08 +0100
  • ae52de9e93
    chore(deps): bump ajv from 6.12.6 to 6.14.0 dependabot[bot] 2026-02-21 15:44:31 +0000
  • b52a26b01d
    chore(release): release 1.11.0 (#6177) 1.11.0 Jakub Bednář 2026-02-19 14:04:56 +0100
  • a0753035a2 chore(release): release 1.11.0 Jakub Bednář 2026-02-19 13:45:34 +0100
  • 514e76562c
    chore(build): upgrade Go to 1.24.13 (#6176) Jakub Bednář 2026-02-18 05:37:20 +0100
  • 131874d98e docs: update CHANGELOG.md to include recent dependency upgrades Jakub Bednář 2026-02-17 18:28:52 +0100
  • 01864eb3d8 chore(build): upgrade Go to 1.24.13 Jakub Bednář 2026-02-17 18:27:24 +0100
  • b9d92c4984
    Merge pull request #6175 from influxdata/dependabot/npm_and_yarn/qs-6.14.2 karel-rehor 2026-02-16 13:15:47 +0100
  • c253368801
    Merge pull request #6171 from influxdata/dependabot/npm_and_yarn/eslint-9.26.0 karel-rehor 2026-02-16 13:12:21 +0100
  • d03e248869
    chore(deps): bump qs from 6.14.1 to 6.14.2 dependabot[bot] 2026-02-14 03:49:42 +0000
  • 5070a6a721 docs: update CHANGELOG.md karel rehor 2026-02-12 17:08:40 +0100
  • e031500e7e chore: tweak eslint.config.mjs and eslint comments in code. karel rehor 2026-02-12 14:25:34 +0100
  • 3d591aa266 chore: bump typescript version to ^4.9.5 karel rehor 2026-02-12 10:57:04 +0100
  • d2f77e9d4d tests: reset cypress/browsers image to 24.13.0 karel rehor 2026-02-12 10:12:19 +0100
  • ddc82ee2d4 tests: make build eslint 9.0 compatible karel rehor 2026-02-11 16:56:52 +0100
  • 79149aa7aa tests: update jest to 30.2 and fix outdated syntax in tests. karel rehor 2026-02-11 15:02:54 +0100
  • 2a5043ce20
    chore(deps-dev): bump eslint from 7.32.0 to 9.26.0 dependabot[bot] 2026-02-10 12:35:21 +0000
  • f576bcebac
    Merge pull request #6174 from influxdata/chore/upgrade-nodejs-24 karel-rehor 2026-02-10 13:34:16 +0100
  • f0ae67feaa tests: revert cypress browsers image to node16.14 newer image leads to some flake in tests karel rehor 2026-02-10 13:15:38 +0100