Release diff: master → previous_release - #24
Closed
Th0rgal wants to merge 2 commits into
Closed
Conversation
* feat: implement automatic server address discovery for API ping feature Add Option 4 (hybrid auto-detect with override) for the dashboard's "API → Server" ping feature: **Plugin Changes:** - Add `server_address` config option to AsyncAnticheatConfig - Send `X-Server-Address` header from plugin when configured **API Changes:** - Extract and store server address from headers in order of priority: 1. Explicit `X-Server-Address` header (from plugin config) 2. Auto-detected from `X-Forwarded-For` header 3. Auto-detected from `X-Real-IP` header - Filter out local/private IPs to avoid storing unusable addresses - Store detected address in `callback_url` column for both handshake and ingest endpoints - Moved `parse_bearer_token` and `sha256_hex` to shared `auth` module - Add `extract_server_address` and `is_local_ip` utilities to `auth` module **Security Improvements:** - Add constant-time comparison for module callback token authentication - Make CORS permissive mode explicit opt-in (requires `CORS_PERMISSIVE_DEV=true`) - Use `subtle` crate for constant-time operations **Documentation:** - Update dashboard docs to explain automatic detection and manual override - Clarify priority order and how the feature works This allows most servers to automatically report their IP without configuration, while providing an override for edge cases (NAT, reverse proxies, etc). * chore: bump plugin version to 0.3.0
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| || ip.starts_with("172.17.") | ||
| || ip.starts_with("172.18.") | ||
| || ip.starts_with("172.19.") | ||
| || ip.starts_with("172.2") |
There was a problem hiding this comment.
Private IP detection incorrectly matches public 172.2.x.x addresses
The pattern ip.starts_with("172.2") incorrectly matches public IP addresses in the 172.2.x.x range as local/private. RFC 1918 defines the private range as 172.16.0.0/12 (172.16.0.0 to 172.31.255.255), so 172.2.x.x addresses are actually public. This pattern was likely intended to match 172.20-172.29, but as written it also matches 172.2.x.x. Servers with public IPs like 172.2.1.1 would have their addresses rejected by extract_server_address, causing the dashboard ping feature to not work for those servers.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated PR. The 'previous_release' branch is force-updated on every push to master to point at the commit before the push, so this PR always represents the current release diff.
Note
Strengthens auth, networking, and UX across API, plugin, and web.
authmodule withparse_bearer_token,sha256_hex, constant‑time comparisons; routes (handshake,ingest,heartbeat,observations, callbacks) refactored to use it and validate tokens in constant timeX-Server-Address/X-Forwarded-For/X-Real-IP; persists toservers.callback_url; plugin sendsX-Server-Addresswhen configuredCORS_PERMISSIVE_DEVflag; defaults to restrictive CORS unless explicitly set; config/env updatedDiskSpoolwrites to temp then atomically renames; sampling predicate adjusted; always capturePLAYER_ABILITIESdespite exemptions; improvedUSE_ITEM_ONfield extraction; newapi.server_addressconfig; handshake/ingest include address; version bump to0.3.0Written by Cursor Bugbot for commit fdd73b5. This will update automatically on new commits. Configure here.