9c31f7e7c8
* Updated our security file with our Huntr. * Fixed a security vulnerability where through the API, an unauthorized user could delete/modify reading lists that did not belong to them. Fixed a bug where when creating a reading list with the name of another users, the API would throw an exception (but reading list would still get created) * Fixed a security vulnerability where through the API, an unauthorized user could delete/modify reading lists that did not belong to them. Fixed a bug where when creating a reading list with the name of another users, the API would throw an exception (but reading list would still get created) * Ensure all reading list apis are authorized * Ensured all APIs require authentication, except those that explicitly don't. All APIs are default requiring Authentication. Fixed a security vulnerability which would allow a user to take over an admin account. * Fixed a bug where cover-upload would accept filenames that were not expected. * Explicitly check that a user has access to the pdf file before we serve it back. * Enabled lock out when invalid user auth occurs. After 5 invalid auths, the user account will be locked out for 10 mins. * Version bump for hotfix release
26 lines
734 B
C#
26 lines
734 B
C#
using System.IO;
|
|
using API.Services;
|
|
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
|
|
namespace API.Controllers;
|
|
|
|
[AllowAnonymous]
|
|
public class FallbackController : Controller
|
|
{
|
|
// ReSharper disable once S4487
|
|
// ReSharper disable once NotAccessedField.Local
|
|
private readonly ITaskScheduler _taskScheduler;
|
|
|
|
public FallbackController(ITaskScheduler taskScheduler)
|
|
{
|
|
// This is used to load TaskScheduler on startup without having to navigate to a Controller that uses.
|
|
_taskScheduler = taskScheduler;
|
|
}
|
|
|
|
public ActionResult Index()
|
|
{
|
|
return PhysicalFile(Path.Combine(Directory.GetCurrentDirectory(), "wwwroot", "index.html"), "text/HTML");
|
|
}
|
|
}
|
|
|