This commit disables path-based app sharing by default. It is possible
for a workspace app on a path (not a subdomain) to make API requests to
the Coder API. When accessing your own workspace, this is not much of a
problem. When accessing a shared workspace app, the workspace owner
could include malicious javascript in the page that makes requests to
the Coder API on behalf of the visitor.
This vulnerability does not affect subdomain apps.
- Disables path-based app sharing by default. Previous behavior can be
restored using the `--dangerous-allow-path-app-sharing` flag which is
not recommended.
- Disables users with the site "owner" role from accessing path-based
apps from workspaces they do not own. Previous behavior can be
restored using the `--dangerous-allow-path-app-site-owner-access` flag
which is not recommended.
- Adds a flag `--disable-path-apps` which can be used by
security-conscious admins to disable all path-based apps across the
entire deployment. This check is enforced at app-access time, not at
template-ingest time.
* added AuditableGroup type
* added json tags
* Anonymizing gGroup struct
* adding support on the FE for nested group diffs
* added type for GroupMember
* Update coderd/database/modelmethods.go
Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com>
* Update coderd/database/modelmethods.go
Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com>
* fetching group members in group.delete
* passing through right error
* broke out into util function and added tests
Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com>
- Deprecates the --experimental flag
- Adds a new flag --experiments which supports passing multiple comma-separated values or a wildcard value.
- Exposes a new endpoint /api/v2/experiments that returns the list of enabled experiments.
- Deprecates the field Features.Experimental in favour of this new API.
- Updates apidocgen to support type aliases (shoutout to @mtojek).
- Modifies apitypings to support generating slice types.
- Updates develop.sh to pass additional args after -- to $CODERD_SHIM.
* refactor: Extract ssh logic from auth service
* Update site/src/i18n/en/userSettingsPage.json
Co-authored-by: Kira Pilot <kira@coder.com>
Co-authored-by: Kira Pilot <kira@coder.com>
* Fix type error in first user setup
* Save auth state
* Add template creation - wip
Remove saved auth state because it wasn't working
* Try adding the rest of the tests
Can't see if they work yet, waiting on a release
* Update playwright
* Update gitignore
* Write tests
* Format
* Update ignores
* Check that start worked
Co-authored-by: Ben Potter <ben@coder.com>
Co-authored-by: Ben Potter <ben@coder.com>
* feat: add experimental button to open vscode locally
This uses the new Coder extension to open up any workspace
with a single click.
* Update site/src/components/VSCodeDesktopButton/VSCodeDesktopButton.stories.tsx
Co-authored-by: Kira Pilot <kira@coder.com>
Co-authored-by: Kira Pilot <kira@coder.com>
Bruno Quaresma