mirror of https://github.com/usememos/memos.git
d88a116fbc
Applied security fixes to the latest upstream (usememos/memos):
- Remove hardcoded JWT secret ("usememos") in demo mode; always use instance secret key
- Enforce DisallowPasswordAuth for all roles including admins (was only blocking regular users)
- Add minimum password length validation (8 chars) on CreateUser and UpdateUser password change
- Restrict CORS to same-origin in production (was allowing all origins on both gateway and connect)
- Add HTTP client timeout (10s) to OAuth2 identity provider
- Remove PII logging of OAuth2 user info claims
https://claude.ai/code/session_018iYDVMmBxJLWBvqugc6tNe
|
||
|---|---|---|
| .. | ||
| auth | ||
| router | ||
| runner | ||
| server.go | ||