Fix critical and high security audit findings

FeatureOpenView on roadmap· 4 days ago

Imported from GitHub pull request El-SaMa/oma#118 by @El-SaMa.

Summary

Close DNS record IDOR and org-owner team takeover paths
Harden operator free discounts (verified emails only), disable seeded 100% coupons, and fail-closed staff sessions
Cap client-surface scopes for portal/Moira, tighten HTML sanitization, webhook SSRF DNS checks, client IP trust, and pre-auth API/MCP rate limits

Add DNS on own domain still works; foreign domainId returns not found
Sub-account with team.manage cannot remove/suspend org owner
Setting billing_email to an operator address no longer grants 100% off
With OMA_OPERATOR_FREE_EMAILS set to a real owner login email, discount still applies
Staff user in client AI/Moira cannot invoke admin-only tools
Public news/tutorial HTML strips svg/onload and javascript: hrefs
Webhook create rejects private IPs and .internal hosts
API/MCP flood with bad keys returns 429 after pre-auth limit

No comments yet.

Join the discussion