Nick Craig-Wood 08490972a5 rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176 ...

Snapshot the NoAuth setting when the RC server is created rather than
reading it from the mutable options struct on each request. This
prevents any runtime mutation of rc.NoAuth (e.g. via options/set)
from disabling the auth gate for protected RC methods.

See GHSA-25qr-6mpr-f7qx

2026-04-19 13:30:46 +01:00

..

jobs

rc: fix formatting in job/batch

2025-11-21 17:06:18 +00:00

js

docs: fix various markdownlint issues

2025-11-01 18:54:19 +01:00

rcflags

rc: convert options to new style

2024-07-15 11:09:54 +01:00

rcserver

rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176

2026-04-19 13:30:46 +01:00

webgui

rc: convert options to new style

2024-07-15 11:09:54 +01:00

cache_test.go

fs/cache: fix parent not getting pinned when remote is a file

2024-09-28 13:49:56 +01:00

cache.go

rc: Add GetFsNamedFileOK to get an fs which could also be a file

2024-02-29 16:21:42 +00:00

config_test.go

rc: add option blocks parameter to options/get and options/info

2024-07-16 15:02:50 +01:00

config.go

rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176

2026-04-19 13:30:46 +01:00

internal_job_test.go

rc: make sure fatal errors don't crash rclone - fixes #8955

2025-11-12 12:22:04 +00:00

internal_test.go

rc: add osVersion, osKernel and osArch to core/version

2025-11-12 11:16:48 +00:00

internal.go

fix: comment typos

2025-11-13 13:47:40 +00:00

params_test.go

build: modernize Go usage

2025-02-28 11:31:14 +00:00

params.go

build: modernize Go usage

2025-02-28 11:31:14 +00:00

rc_test.go

fs/rc: add more infrastructure to help writing rc functions

2018-11-02 17:32:20 +00:00

rc.go

config: make parsing of duration options consistent

2025-07-08 12:08:14 +02:00

registry.go

config: fixed issues with flags/options set by environment vars.

2021-07-05 16:38:20 +01:00