6 Commits

Include renames

Author	SHA1	Message	Date
Donkie	97524b1107	security: refuse requests addressed to a host we do not answer to ... Closes the DNS rebinding hole, which the origin guard structurally cannot: under rebinding the attacker's page keeps its own name, so Origin and Host agree with each other and the origin guard trusts them both, while the address behind that name is the victim's Spoolman instance. The default allows everything a stranger cannot point at someone else's machine -- any IP literal, any single-label name, and the non-registrable suffixes -- because what the attack needs is a registrable public domain. That leaves a reverse proxy on a real domain, which cannot be told apart from the attack and so must declare itself via SPOOLMAN_ALLOWED_HOSTS.	2026-07-31 09:29:47 +02:00
Donkie	205574fa2c	Fixed timezone being returned incorrectly ... Happened if you've set TZ to non-UTC. Apparently astimezone and replace doesn't do the same thing even if tzinfo is None.	2023-10-02 21:36:50 +02:00
Donkie	f24b9610e8	Added automatic nightly SQLite backups ... Resolves #22	2023-07-04 14:59:05 +02:00
Donkie	3aec319b6a	Now correctly handles datetimes with timezone set	2023-06-25 17:57:17 +02:00
Donkie	de1bf05922	Added Alembic for migrations	2023-05-27 23:14:06 +02:00
Donkie	5e75d6d70e	Run integration tests on all db types	2023-05-21 23:38:41 +02:00