-
06c427ee39
backup-restore: Toast bei Erfolg, ausführliche Fehlermeldung im Dialog
duffyduckandClaude Opus 4.7
2026-05-19 08:20:16 +02:00
-
2cb6f172c9
Login-Rate-Limit pro (IP + Email)-Tupel + PUT /portal verbietet password
duffyduckandClaude Opus 4.7
2026-05-18 21:18:59 +02:00
-
0f2dc44e45
cleanup: hacker@-Marker raus (legitime Nachnamen "Hacker")
duffyduckandClaude Opus 4.7
2026-05-18 20:50:36 +02:00
-
b87a2a3d08
fix: Cleanup im echten Entrypoint + idempotente Migration
duffyduckandClaude Opus 4.7
2026-05-18 20:24:33 +02:00
-
48fe69cdab
Security-Hardening Runde 17: JWT-TTL + Pentest-Marker-Detection
duffyduckandClaude Opus 4.7
2026-05-18 20:06:03 +02:00
-
373fab8e83
Security-Hardening Runde 16: KRITISCH – Update-Responses sanitisieren
duffyduckandClaude Opus 4.7
2026-05-18 18:43:45 +02:00
-
5ffd1a4d2c
fix: prisma.ts baut DATABASE_URL aus DB_*-Vars (für docker exec)
duffyduckandClaude Opus 4.7
2026-05-18 15:57:15 +02:00
-
7b9a1981a7
fix: src/ ins Runtime-Image, damit prisma/*.ts-Wartungsskripte laufen
duffyduckandClaude Opus 4.7
2026-05-18 15:53:52 +02:00
-
3dda83314a
Admin-Rescue: PW-Reset direkt in DB + Rate-Limit-Reset
duffyduckandClaude Opus 4.7
2026-05-18 15:47:02 +02:00
-
3e1fc3eab2
Mitarbeiter-Passwörter auf 25 Zeichen (BSI-Empfehlung)
duffyduckandClaude Opus 4.7
2026-05-18 15:19:58 +02:00
-
cf8c6c84c2
Security-Hardening Runde 15: Pentest Runde 12 Folge-Fixes
duffyduckandClaude Opus 4.7
2026-05-18 15:09:13 +02:00
-
d545790a69
Security-Hardening Runde 14: Factory-Reset, Settings-Whitelist, Prisma-Leak, XSS-Strip
duffyduckandClaude Opus 4.7
2026-05-18 05:23:12 +02:00
-
ef238b0145
Security-Hardening Runde 13: Live-Vollmacht-Konsistenz + embedded DTOs
duffyduckandClaude Opus 4.7
2026-05-17 21:47:20 +02:00
-
7b6b586033
fix: PortalPrivacy weiße Seite – Hooks-Reihenfolge nach early-return
duffyduckandClaude Opus 4.7
2026-05-17 09:33:40 +02:00
-
3dea381983
fix: UUID-Hashes (Datenschutz-Link) nicht als truncated-ID blocken
duffyduckandClaude Opus 4.7
2026-05-17 09:21:52 +02:00
-
28c91759df
Security-Hardening Runde 12: Information-Disclosure + Input-Validation
duffyduckandClaude Opus 4.7
2026-05-17 08:51:52 +02:00
-
c744eebfa3
Rate-Limit-Liste: bereits freigegebene IPs ausblenden
duffyduckandClaude Opus 4.7
2026-05-17 01:26:12 +02:00
-
956bc394b8
Rate-Limit-Sperren: Admin-UI zum Freigeben
duffyduckandClaude Opus 4.7
2026-05-17 01:20:43 +02:00
-
69b9a35674
Security-Hardening Runde 11: Pentest Runde 7 (Portal-PW + Download-Tokens)
duffyduckandClaude Opus 4.7
2026-05-17 00:40:00 +02:00
-
a982795388
Security-Hardening Runde 10: Pentest Runde 6 (8 Findings + struktureller Audit-Sweep)
duffyduckandClaude Opus 4.7
2026-05-16 23:47:17 +02:00
-
38c2d82c02
Security-Hardening Runde 9: Pentest Runde 5
duffyduckandClaude Opus 4.7
2026-05-16 22:57:09 +02:00
-
75c833500e
Security-Hardening Runde 8: Cockpit-IDOR (Portal sah ALLE Kunden)
duffyduckandClaude Opus 4.7
2026-05-16 19:55:38 +02:00
-
a7d12b8540
Security-Hardening Runde 7: Pentest Runde 3 (3 Findings)
duffyduckandClaude Opus 4.7
2026-05-16 19:39:02 +02:00
-
8534be22d0
Einmalpasswort-Flow für Portal-Credentials
duffyduckandClaude Opus 4.7
2026-05-16 18:48:13 +02:00
-
f0c97cd46d
todo.md: Passwort-Komplexität + Real-IP-Fix dokumentiert
duffyduckandClaude Opus 4.7
2026-05-16 18:26:52 +02:00
-
8a5ffbb563
Passwort-Komplexität + Portal-Credentials-UX
duffyduckandClaude Opus 4.7
2026-05-16 18:26:11 +02:00
-
6af1a4bbd4
fix(security): trust proxy = 1 bei HTTPS_ENABLED – echte Client-IP statt Proxy-IP
duffyduckandClaude Opus 4.7
2026-05-16 18:24:21 +02:00
-
92d2e62e79
security: portalPasswordHash + Encrypted aus embedded customer in /contracts/* entfernen
duffyduckandClaude Opus 4.7
2026-05-16 18:06:01 +02:00
-
08310ac302
security: CRITICAL IDOR-Fix auf Stressfrei-Email-Sub-Routes
duffyduckandClaude Opus 4.7
2026-05-16 17:47:54 +02:00
-
72f7a9dbdb
docs: BREACH-/-Marker konkret entfernen – exact-match-Location erklärt
duffyduckandClaude Opus 4.7
2026-05-16 17:35:48 +02:00
-
c5dc271759
docs: BREACH-Marker auf SPA-Root / als bewusst akzeptiert dokumentieren
duffyduckandClaude Opus 4.7
2026-05-16 16:59:49 +02:00
-
1451e362ff
chore(env): JWT_EXPIRES_IN 15m + JWT_REFRESH_EXPIRES_IN dokumentieren
duffyduckandClaude Opus 4.7
2026-05-16 16:53:40 +02:00
-
8188d17c87
fix(gdpr): processedBy aus useAuth statt totem localStorage('user')
duffyduckandClaude Opus 4.7
2026-05-16 16:51:02 +02:00
-
c4e62f0f50
docs: Pentest-Runden 11 + 12 in SECURITY-HARDENING + README aktualisieren
duffyduckandClaude Opus 4.7
2026-05-16 16:12:05 +02:00
-
9830ac29a5
security: JWT raus aus localStorage – Refresh-Cookie-Pattern für SPA
duffyduckandClaude Opus 4.7
2026-05-16 16:06:17 +02:00
-
0943f11999
security: Audit-Log für alle Klartext-Passwort-Reads (CRITICAL)
duffyduckandClaude Opus 4.7
2026-05-16 15:33:26 +02:00
-
e2cd26a29e
feat(monitoring): Manueller Refresh-Button im Sicherheits-Monitoring-Log
duffyduckandClaude Opus 4.7
2026-05-16 15:20:00 +02:00
-
f6df97226d
feat(email): Weiterleiten + Erneut senden im Detail-Pane
duffyduckandClaude Opus 4.7
2026-05-16 14:46:44 +02:00
-
185b38dc55
feat(email): Suchleiste + erweiterte Filter im Email-Postfach
duffyduckandClaude Opus 4.7
2026-05-16 14:31:43 +02:00
-
51eb12b414
fix(stressfrei): Refresh-Button nur bei provisioned + Auto-Heilung im Status-Sync
duffyduckandClaude Opus 4.7
2026-05-16 14:11:47 +02:00
-
c2ebc7cf1e
fix(stressfrei): sync-forwarding sichtbar + Passwort-Push + Toast-Meldungen
duffyduckandClaude Opus 4.7
2026-05-16 14:06:26 +02:00
-
b4be3cebfb
feat(stressfrei): Weiterleitungen manuell synchronisieren
duffyduckandClaude Opus 4.7
2026-05-16 13:53:48 +02:00
-
083913cadb
docs: README – more_clear_headers Server X-Served-By dazu (Banner weg)
duffyduckandClaude Opus 4.7
2026-05-16 13:36:49 +02:00
-
4c0cc90734
docs: README – BREACH-Schutz via gzip off für /api/* am Reverse-Proxy
duffyduckandClaude Opus 4.7
2026-05-16 13:33:54 +02:00
-
70e97d3ece
security: Header-Hygiene-Runde 11 (Pentest-Cleanup)
duffyduckandClaude Opus 4.7
2026-05-16 11:46:49 +02:00
-
8dff0310a6
fix(csp): frame-ancestors auf 'self' – PDF-Vorschau-iframe ging nicht
duffyduckandClaude Opus 4.7
2026-05-07 20:10:42 +02:00
-
ab971618d5
factory-import: --save-as-builtin Flag + README-Überarbeitung
duffyduckandClaude Opus 4.7
2026-05-07 20:04:02 +02:00
-
4407bbfbb8
factory-defaults: CLI-Sync zwischen dev und prod
duffyduckandClaude Opus 4.7
2026-05-07 19:51:19 +02:00
-
365c7994d5
factory-defaults: builtin-Werkseinstellungen beim Auto-Seed einspielen
duffyduckandClaude Opus 4.7
2026-05-07 19:41:16 +02:00
-
2c7a87ccd3
factory-defaults: HTML-Templates + Import über UI
duffyduckandClaude Opus 4.7
2026-05-07 19:26:33 +02:00
-
45f63d1c48
docs: User-DSGVO-/Entwickler-Zugriff-Fix in Erledigt-Liste
duffyduckandClaude Opus 4.7
2026-05-07 18:27:18 +02:00
-
2d3ca28691
fix(users): DSGVO-/Entwickler-Zugriff über User-Update durchreichen
duffyduckandClaude Opus 4.7
2026-05-07 18:27:02 +02:00
-
4201a90fd0
docs: HTTPS_ENABLED-Flag in Erledigt-Liste dokumentieren
duffyduckandClaude Opus 4.7
2026-05-07 18:00:56 +02:00
-
3fb1925a98
security: HTTPS-only-Header per HTTPS_ENABLED-Flag steuern
duffyduckandClaude Opus 4.7
2026-05-07 18:00:01 +02:00
-
63ebf3e75f
db: tsx in production-deps + npx-Prefix für seed-Command
duffyduckandClaude Opus 4.7
2026-05-07 17:23:06 +02:00
-
27a0fdbc45
db: Prisma-Migrations-System statt db push (datenerhaltend)
duffyduckandClaude Opus 4.7
2026-05-07 17:02:35 +02:00
-
6f293211a4
docker: Auto-Seed bei leerer DB (kein RUN_SEED-Toggle nötig)
duffyduckandClaude Opus 4.7
2026-05-07 15:37:34 +02:00
-
70e5190594
docker: DATABASE_URL im entrypoint URL-encoden (Sonderzeichen-Bug auf Prod)
duffyduckandClaude Opus 4.7
2026-05-07 15:25:13 +02:00
-
7d07d52774
docker: App-User statt root für DB-Connection nutzen
duffyduckandClaude Opus 4.7
2026-05-07 15:06:43 +02:00
-
75c1f9a7bb
docker-compose url
duffyduck
2026-05-07 14:58:13 +02:00
-
62010b05d5
.env: DATABASE_URL aus DB_*-Komponenten zusammenbauen (kein Doppel-Pflegen)
duffyduckandClaude Opus 4.7
2026-05-07 14:41:39 +02:00
-
e401c11e40
removed docker veriosn from docker-compose.yml
duffyduck
2026-05-07 14:27:37 +02:00
-
d206b360a6
security: Permissions-Policy-Header setzen (Pentest-Finding)
duffyduckandClaude Opus 4.7
2026-05-05 15:25:27 +02:00
-
096aa63c6f
security: Content-Security-Policy aktivieren (Pentest-Finding)
duffyduckandClaude Opus 4.7
2026-05-05 15:22:01 +02:00
-
77602bb4ac
contracts: VVL (Vertragsverlängerung) als Split-Button neben Folgevertrag
duffyduckandClaude Opus 4.7
2026-05-03 09:12:39 +02:00
-
e763952a84
adminer: Theme-Bootstrap für Designs mit non-Standard CSS-Filenamen
duffyduckandClaude Opus 4.7
2026-05-02 10:26:20 +02:00
-
3823f8aa50
backup: SecurityEvent-Tabelle im Backup + Restore mit aufnehmen
duffyduckandClaude Opus 4.7
2026-05-02 10:19:18 +02:00
-
0671565433
docker: Runtime auf node:20-slim (Alpine→Debian) – Prisma+TLS-Kompatibilität
duffyduckandClaude Opus 4.7
2026-05-01 20:05:37 +02:00
-
e145edaa90
docker: zentrale .env + Compose mit MariaDB+OpenCRM+Adminer + Bind-Mounts
duffyduckandClaude Opus 4.7
2026-05-01 18:53:19 +02:00
-
3b4a680326
chore: backend/.env aus Git entfernt + .gitignore klargestellt
duffyduckandClaude Opus 4.7
2026-05-01 18:35:00 +02:00
-
389b878dbd
Monitoring: Threshold-Debounce auf sliding-window (statt floor-to-hour)
duffyduckandClaude Opus 4.7
2026-05-01 10:11:52 +02:00
-
96feb6a663
v1.1.0: Production-readiness Release
v1.1.0
duffyduckandClaude Opus 4.7
2026-05-01 09:42:56 +02:00
-
49905aa97e
Monitoring: Pagination mit Seitenzahlen + Anfang/Ende-Buttons
duffyduckandClaude Opus 4.7
2026-05-01 09:36:40 +02:00
-
e2fdb069ac
Monitoring UX: Log leeren + PageSize wählbar
duffyduckandClaude Opus 4.7
2026-05-01 09:31:53 +02:00
-
0cf3dd6a7b
Security-Hardening Runde 10: Security-Monitoring + Alerting
duffyduckandClaude Opus 4.7
2026-05-01 09:25:47 +02:00
-
45fe270a38
Security-Hardening Runde 9: Diminishing returns
duffyduckandClaude Opus 4.7
2026-05-01 08:47:20 +02:00
-
73f271ae03
docs: todo.md von backend/ nach docs/ verschoben
duffyduckandClaude Opus 4.7
2026-05-01 08:23:27 +02:00
-
4385ae575d
docs: Security-Hardening in eigene MD ausgelagert + Live-Tabellen
duffyduckandClaude Opus 4.7
2026-05-01 08:15:38 +02:00
-
6b804cdc82
Security-Hardening Runde 8: DNS-Rebinding + Per-File-Ownership
duffyduckandClaude Opus 4.7
2026-05-01 07:59:19 +02:00
-
df6eb9724d
Security-Hardening Runde 7: SSRF-Schutz + Logout-Endpoint
duffyduckandClaude Opus 4.7
2026-05-01 07:47:26 +02:00
-
0c0cecdbbd
Security-Hardening Runde 6: Customer-Liste-Leak + XFF-Bypass + Vollmacht-Validation
duffyduckandClaude Opus 4.7
2026-04-26 20:14:20 +02:00
-
35745ce3bb
Security-Hardening Runde 5: Hack-Das-Ding (DSGVO-GAU + Timing + XSS)
duffyduckandClaude Opus 4.7
2026-04-25 00:21:37 +02:00
-
dea2da0271
Vertragsstatus-Trigger: Datum beim Upload miterfassen
duffyduckandClaude Opus 4.7
2026-04-24 13:40:04 +02:00
-
0a757d8e47
Auto-Vertragsstatus: Lieferbestätigung hochladen → DRAFT auf ACTIVE
duffyduckandClaude Opus 4.7
2026-04-24 10:20:30 +02:00
-
4e680a36e7
Auto-Vertragsstatus: nightly EXPIRED + Kündigungsbestätigung → CANCELLED
duffyduckandClaude Opus 4.7
2026-04-24 10:08:58 +02:00
-
a129781035
docs(todo): Live-verifiziert-Tabelle für Security-Runde 4 ergänzt
duffyduckandClaude Opus 4.7
2026-04-24 10:01:26 +02:00
-
4ca91eb710
Security-Hardening Runde 4: 9 Live-IDORs + Error-Handler
duffyduckandClaude Opus 4.7
2026-04-24 09:59:37 +02:00
-
8aead8c2f6
Security-Hardening Runde 3: JWT, trust-proxy, weitere IDORs, Attachment-Härtung
duffyduckandClaude Opus 4.7
2026-04-24 09:38:25 +02:00
-
301aafffd1
chore: helmet korrekt in backend/package.json statt Root
duffyduckandClaude Opus 4.6
2026-04-23 23:02:12 +02:00
-
81f0e89058
Security-Hardening Runde 2: Zip-Slip, Mass Assignment, weitere IDORs, Path-Traversal
duffyduckandClaude Opus 4.6
2026-04-23 22:59:28 +02:00
-
1c46d7345c
Security-Hardening: IDOR-Fixes, XSS-Sanitizer, CORS+Helmet, Data-Exposure
duffyduckandClaude Opus 4.6
2026-04-23 22:06:16 +02:00
-
8fc050a282
docs: TESTING.md mit Check-Listen für Security + Email-Log-System
duffyduckandClaude Opus 4.6
2026-04-23 17:21:34 +02:00
-
0764bc6ddf
Version 1.0.0: Passwort-Reset + Rate-Limiting + Auto-Geburtstagsgrüße
duffyduckandClaude Opus 4.6
2026-04-23 17:14:27 +02:00
-
8d113f4c6b
Backup/Restore: alle neuen Tabellen erfasst (43 Tabellen insgesamt)
duffyduckandClaude Opus 4.6
2026-04-23 16:53:26 +02:00
-
fd480113d0
docs: Plesk API-Key - Hinweis dass 0.0.0.0 nicht funktioniert
duffyduckandClaude Opus 4.6
2026-04-23 16:44:31 +02:00
-
95bf118fc2
docs: Plesk-API-Key-Anleitung in README ergänzt
duffyduckandClaude Opus 4.6
2026-04-23 16:27:54 +02:00
-
075c095b8e
todo: SaaS-Ausbau-Plan (Instance-per-Customer + GoCardless) dokumentiert
duffyduckandClaude Opus 4.6
2026-04-23 16:24:37 +02:00
-
3fa1dce2dc
UX: Label-Feld aus Provider-Formular entfernen
duffyduckandClaude Opus 4.6
2026-04-23 16:00:41 +02:00
-
b7d3654b72
Fix: Provider-Domain greift sofort + Domain-Validierung
duffyduckandClaude Opus 4.6
2026-04-23 15:51:16 +02:00
-
cdde7b4ab7
Mandantenfähigkeit: Domain + Kunden-E-Mail-Label dynamisch pro Provider
duffyduckandClaude Opus 4.6
2026-04-23 15:43:19 +02:00