matchSiteID guarded most authenticated and admin routes with
`if siteID != "" && user.SiteID != siteID`. Dropping the ?site= query
parameter made the check no-op and any authenticated user passed the
middleware. Downstream handlers fell back to reading site from the JSON
body or just used the empty string, so on email/telegram subscribe
endpoints (which read site from body) a user authenticated to siteA
could perform actions targeting siteB without the cross-site guard
ever firing.
Require ?site= to be present and to match user.SiteID. Body-only site
flows are still supported provided the URL also carries the matching
?site= — both must agree, which removes the bypass and keeps the
declared site visible to the middleware.
Reproduction TestRest_matchSiteID enumerates four cases (matching,
mismatched, missing, empty). Existing test calls that relied on the
implicit pass had to add ?site=remark42 to the URL: the addComment
helper now derives the param from c.Locator.SiteID, picture upload
URL gets the param explicitly, and the email/telegram subscribe table
adds it to every endpoint. The negative cases that previously asserted
StatusBadRequest from the handler now correctly assert StatusForbidden
from the middleware.
Apply go fix ./... analysers (Go 1.26) across backend and examples:
- interface{} → any (type alias, no behaviour change)
- for i := 0; i < N; i++ → for range N / for i := range N
- slices.Contains / slices.ContainsFunc replacing manual loops
- strings.SplitSeq replacing strings.Split in range (avoids allocation)
- strings.CutPrefix replacing HasPrefix+TrimPrefix
- min() replacing manual if/else
- fmt.Appendf replacing []byte(fmt.Sprintf(...))
- strings.Builder replacing string += concatenation
- wg.Go(func(){}) replacing wg.Add(1)/go/wg.Done() pattern
- removed redundant ii := i loop variable copies (unnecessary since Go 1.22)
omitempty on struct-typed JSON fields: go fix removed omitempty from
struct-typed fields (time.Time, PostInfo, UserDetailEntry) because
encoding/json's omitempty never applied to struct types — it was always
a no-op. Kept as bare tags (no omitzero replacement) to preserve the
existing serialisation behaviour.
Allowed domains consist of `REMARK_URL` second-level domain (or whole IP in case it's IP like `127.0.0.1`) and `ALLOWED_HOSTS`. That is needed to prevent Remark42 from asking arbitrary servers and storing the page title as the comment.PostTitle.
Previous behaviour allowed the caller of the API to create a comment
with an arbitrary URL and learn the title of the page, which might be
accessible to the server Remark42 is installed on but not to the user
outside that network (CWE-918).
* increase timeout for TestServerAuthHooks http client
* replace assert.Equal checks for slice length with require.Equal
* unify channel name across tests
* fix panic in Test_Main
* increase TestRest_CreateWithPictures timeout for HDD slowness
* increase TestService_VoteSameIPWithDuration timeout for HDD slowness
* increase go test timeout for HDD run
* increase TestRest_CreateWithPictures timeout for HDD slowness
* improve TestServer* reliability
* improve TestService_UserReplies reliability
* increase timeout for Test_Main
* improve TestRest_CreateWithPictures readability and reliability
* introduce random port to REST over SSL tests
* tinker TestRest_InfoStreamSince to have more slack before failure
* finalize test errors check unification
* simplify prepServerApp in cmd package tests
* improve TestRest_InfoStreamCancel reliability
* make tests more resilient
* adjust drone for v1.x and dev-box, remove travis support
* add backend build step on branch for drone
* fix from email
* change notif email
* less demanding test wait
* add settings section to drone plugins
* adjust branch build
* convert all drone ci docker confs
* rename drone targets
* WIP: start with aud verification
* adjust rest test for token's site_id remark42
* add tests for non-matching aud
* fix auth hook test with updates limiter
* check siteID with enabled call for static store
* fix site enabled check
* fresh vendor
* enforce vendor flag with env
* move tree to service package
* move controllers routing to rest.go, remove separate subrouters
* cleanup/formatting
* missing vendor packages
* move rss, img proxy, robots and getstarted to top-level routes
* simplify logger middleware usage
* randomize server test ports
* check for non-admin in admin tests
* lint: minor warns
* admin test to jwt admin
Dmitry VerkhoturovandUmputun
