mirror of https://github.com/usememos/memos.git
d88a116fbc
Applied security fixes to the latest upstream (usememos/memos):
- Remove hardcoded JWT secret ("usememos") in demo mode; always use instance secret key
- Enforce DisallowPasswordAuth for all roles including admins (was only blocking regular users)
- Add minimum password length validation (8 chars) on CreateUser and UpdateUser password change
- Restrict CORS to same-origin in production (was allowing all origins on both gateway and connect)
- Add HTTP client timeout (10s) to OAuth2 identity provider
- Remove PII logging of OAuth2 user info claims
https://claude.ai/code/session_018iYDVMmBxJLWBvqugc6tNe
|
||
|---|---|---|
| .. | ||
| cron | ||
| filter | ||
| httpgetter | ||
| idp | ||
| markdown | ||
| scheduler | ||
| storage/s3 | ||
| webhook | ||