cclohmar
e831fcf617
CR-1: Path traversal in createReceiptZip — validate image_path is within storage/ CR-2: Missing authz on EditExpense/UpdateExpense — verify event ownership CR-3: OTP timing side-channel — use crypto/subtle.ConstantTimeCompare CR-4: Logout doesn't invalidate session — moved to AuthHandler with Sessions.Delete() CR-5: OTP reuse race condition — mutex lock around validate+delete CR-6: Live credentials on disk — removed .env from disk entirely CR-7: No TLS — documented as expected behind-proxy deployment Additional: - Removed stale github.com/expenseflow import path from auth.go - Made EnvironmentFile optional (prefix with -) so .env is not required - App runs and starts clean without any .env file
25 lines
559 B
Desktop File
25 lines
559 B
Desktop File
[Unit]
|
|
Description=ReceiptNext — AI-Powered Expense Tracker
|
|
Documentation=https://git.lohmar.co.uk/cclohmar/ReceiptNext
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=receiptnext
|
|
Group=receiptnext
|
|
WorkingDirectory=/opt/receiptnext
|
|
ExecStart=/opt/receiptnext/app
|
|
Restart=always
|
|
RestartSec=5
|
|
EnvironmentFile=-/opt/receiptnext/.env
|
|
StandardOutput=append:/var/log/receiptnext.log
|
|
StandardError=append:/var/log/receiptnext.log
|
|
|
|
# Security hardening
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectSystem=full
|
|
ProtectHome=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|