coinos-server.git/routes/email.ts, branch mastercoinos server — legacy coinos.io backend (Lightning, on-chain, Liquid)https://git.coinos.io/coinos-server.git/atom?h=master2026-10-07T04:12:19Zemail: escape support form HTML and enforce recaptcha v3 score2026-10-07T04:12:19ZAdam Soltysadam@coinos.io2026-10-07T04:12:19Zurn:sha1:fb7c0086bbfcf17fbaba1ea83a1e3faf2849315b
Escape the message body, stop accepting a client-supplied subject, strip
control characters from header values, require the expected action and a
minimum score from siteverify, and drop the adminpass captcha bypass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
auth: fail closed on adminpass, scrub sample secrets (S3)2026-08-08T06:29:25ZAdam Soltysadam@coinos.io2026-08-08T05:59:21Zurn:sha1:d513ab75131bfaa16b1f0820d0fb18ad9e7f6ab1
The master-password path (isAdmin = password === config.adminpass) logs
in as any user, skipping password, 2FA, and captcha. Worse, when
adminpass is unset an omitted password field made undefined === undefined
true, authenticating as anyone. Require both the configured value and the
supplied password to be non-empty and match exactly, across every
adminpass comparison (login, recaptcha bypass, support email, freeze).
Also scrub config.ts.sample: the sample shipped a working-looking JWT
secret, two server nsec keys, and adminpass "pwa". Replace with
fail-closed placeholders and regenerate instructions. Rotate any
deployment that ever shipped the sample values.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
remove logs2026-03-17T06:53:13ZAdam Soltysasoltys@gmail.com2026-03-17T06:53:13Zurn:sha1:92e7d1564deb25f9e58e3b268c077018c4b2c4c4biome lint2024-10-31T16:34:42ZAdam Soltysadam@coinos.io2024-10-31T16:29:04Zurn:sha1:aa4cd39c943b67169def224e224bd07b815b70ectypescript2024-08-27T04:17:43ZAdam Soltysasoltys@gmail.com2024-08-27T04:17:43Zurn:sha1:fe62cadd6fb4a7e49f7d59401fc74ae0411e32a7