admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Release 8.3.0 case list, and security findings mapped to cases

Browse Source 
John's "next release" cases (exported 2026-10-24) listed in NET10-PORT.md;
SECURITY-REVIEW.md maps each finding to its case. F28 has no case yet.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-24 10:09:59 -07:00
parent ba60825167
commit 67205ccf41
2 changed files with 72 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

63
devdocs/modernization/NET10-PORT.md
View File

@@ -167,6 +167,69 @@ suite is waiting on (case 4653, case 4654, the contract issue).
---
## Release 8.3.0 cases
John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own set of commits on
`main` (`case NNNN - …`). Status: open unless noted. Security cases map to findings in
`SECURITY-REVIEW.md` (finding IDs are permanent).
**Security review** (priority 00)
| Case | Name | Findings |
|---|---|---|
| 4710 | 2FA step requires the temp token (raven and sockeye) | F5, F41 |
| 4711 | Placeholder/short JWT secret treated as unset | F1 |
| 4712 | Customer contact route allowlist + ownership checks | F13, F14, F15, F16, F17 |
| 4715 | Download file names checked (one helper) | F21 |
| 4716 | Pick-list search text as SQL parameters | F18 |
| 4717 | KPI interval allowlist | F26 |
| 4718 | Report and translation import need create rights | F19, F24 |
| 4719 | Report page network restricted; notification reports not run as SuperUser | F20 |
| 4720 | Restricted roles filtered in report/export data | F27 |
| 4721 | Client escaping of record text | F33 |
| 4722 | DOMPurify and Vuetify upgrades (raven-client) | F34 |
| 4723 | Direct SMTP: address from the record only | F3, F4 |
| 4724 | SMTP: certificate checked, password never returned | F30, F31 |
| 4725 | Sessions: password change ends sessions, exact-path token exemption, default SuperUser refused when licensed | F7, F8, F9 |
| 4726 | Login throttling/lockout | F6 |
| 4727 | Low severity hardening | F2, F10, F11, F12, F22, F23, F25, F29, F35, F36, F38, F39, F40 |
| (none yet) | Contact users limited to customer roles | **F28** |
**From the port and earlier triage**
| Case | Name | Priority |
|---|---|---|
| 4692 | SuperUser can be deleted | 00 |
| 4693 | FormFieldReference start-up race | 00 |
| 4654 | General notification delivers at most once per 12 hours (circuit breaker) | 00 |
| 4694 | Standalone launcher not shutting down PostgreSQL (raven-launcher) | 1 |
| 4695 | Shipping the Visual C++ runtime DLLs with the standalone install | 1 |
| 4696 | JWT secret missing from the standalone config.json | 1 |
| 4697 | Relative date filters using the server's time zone | 1 |
| 4698 | JWT placeholder in the LAN and Linux templates (same subject as 4711) | 1 |
| 4699 | Linux desktop data-path note in the manual | 1, docs |
| 4700 | Restore note for customers with a dedicated database role | 1, docs |
| 4703 | Report JS console error logging | 1 |
| 4705 | License.DoFetchAsync never tries the fifth licence server | 1 |
| 4706 | Remove the unused RunProgram.Run | 1 |
| 4707 | Stray cypress.json in raven-client | 1, investigate |
| 4687 | Generator polls every second (raven and sockeye) | 1 |
| 4682 | Time-only picker keeps the old date's DST offset | 1 |
| 4665 | Health route: does it check the database? | 1, feature |
| 4661 | Docs: password guidance | 1, docs |
| 4636 | Docs: turn off 2FA before v7 to v8 migration | 1, docs |
| 4634 | Docs: custom checkbox shows nothing for older records | 1, docs |
| 4633 | Docs: pg_dump path quoting on Windows (likely fixed by the port; confirm) | 1, docs |
| 4632 | AYANOVA_REPORT_RENDER_API_URL_OVERRIDE breaks customer notification reports | 1, investigate |
| 4628 | Deleting a work order tied to a CSR gives a raw server error | 1, bug |
| 4623 | Docs: migration, what is erased and what is kept | 1, docs |
| 4602 | Logo upload UI: hide Upload and Delete until usable | 1, client |
| 4579 | Windows permissions on folders AyaNova writes to (installers, docs, code) | 1, investigate |
| 4690 | .NET 10 port umbrella case | 1 |
Later, not 8.3.0: F42 (move the licence signing key out of Sockeye source) and F32 (rotate the
FastMail password after the old Sockeye server is retired), John's cases.
## Open questions
- Release version number (Sockeye's port was released as 8.1.0) Answer: 8.3.0 will be the version

9
devdocs/modernization/SECURITY-REVIEW.md
View File

@@ -846,6 +846,15 @@ Any logged-in user can add a general notification, with the sender's name and an
any user id. Low on its own (in-app only); relevant with F3 for social engineering of staff
by a customer contact. Pass 8: confirmed from code (`NotifyController.SendNotifyDirectMessage`, no role check, any `ToUserId`). Fix: staff only, or only to users the caller may see.
## Cases
John's cases for the findings (created 2026-10-24; full list in `NET10-PORT.md`, "Release 8.3.0
cases"): 4710 (F5, F41), 4711 (F1), 4712 (F13 to F17), 4715 (F21), 4716 (F18), 4717 (F26),
4718 (F19, F24), 4719 (F20), 4720 (F27), 4721 (F33), 4722 (F34), 4723 (F3, F4), 4724 (F30, F31),
4725 (F7, F8, F9), 4726 (F6), 4727 (F2, F10, F11, F12, F22, F23, F25, F29, F35, F36, F38, F39,
F40). **F28 has no case yet.** Not in 8.3.0: F32, F42 (John's later cases); F37 accepted. When a
case is done, its findings' status becomes *fixed in case NNNN*.
## Customer contact route allowlist (draft, for the F13 to F17 fix)
The API routes the client can call for a customer contact (`UserType` Customer or HeadOffice),