s.gruessing/IT-Nexus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
33 Commits 1 Branch 0 Tags
81b1c326fc8126f53ff17723b6fc23c7acfc0bc4
Commit Graph

6 Commits

Author SHA1 Message Date
Simon Grüssing
81b1c326fc Security: WS-Rollenprüfung, JWT-Cookie statt localStorage, XSS/SSRF-Fixes, RDP-Consent-Secret
Some checks failed
IT Nexus Deploy / Build Frontend (push) Has been cancelled
Details
IT Nexus Deploy / Deploy to Production (push) Has been cancelled
Details 
- WebSocket Shell/RDP: Rollenprüfung statt nur JWT-Gültigkeit (war: jeder eingeloggte User konnte fremde Agents per Shell/RDP übernehmen)
- JWT_SECRET: Server bricht ab statt mit unsicherem Default weiterzulaufen
- Auth: Token läuft jetzt über httpOnly-Cookie statt localStorage (XSS-Schutz gegen Session-Diebstahl)
- WS-Auth: Token nicht mehr als URL-Query-Param (landete in nginx-Logs), sondern als erste Message bzw. automatisch via Cookie
- Frontend: toter Rollen-Check (isSuperAdmin/isAdmin ohne Funktionsaufruf) in AgentDetailPage gefixt
- XSS: DOMPurify-Sanitizing für alle marked.parse()-Renderstellen (KI-Antworten, Kommentare, Knowledge Base)
- E-Mail: HTML-Escaping für alle ticket-gesteuerten Felder (auch über öffentliche Ticket-Route erreichbar)
- SSRF-Schutz beim Knowledge-Base-URL-Import (blockt private/Loopback-Adressen)
- TV-Dashboard: Shared-Key statt komplett offenem Endpoint
- Striktes Rate-Limit auf /login, must_change_password serverseitig erzwungen
- Agent (C#) v2.7.0: RDP-Consent/Disconnect/Capture verlangen jetzt ein Pro-Session-Secret (war: jeder lokale Prozess konnte Consent vortäuschen), DataDir-ACL für agent.log/status.json
- FIDO-PINs AES-256-GCM-verschlüsselt statt Klartext, Retention-Job für alte patch_commands/audit_log

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-26 13:27:17 +02:00
Simon Grüssing
058f968af1 Add Remote Desktop screen selector + new-tab button (v2.2.0) 
- CaptureModeRunner: screen index param (0=all, 1-N=specific monitor)
- RtcService: reads screen from rdp_start JSON, passes to capture helper
- Program.cs: parses optional screen index arg for --rdp-capture
- RemoteDesktopPanel: screen dropdown (Alle/1-4), new-tab button
- RdpPage: fullscreen standalone page at /rdp/:agentId
- AgentDetailPage: removed dead _RemoteDesktopOld_unused code

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-11 10:15:00 +02:00
Simon Grüssing
1461f0fd0d Fix Remote Desktop: img → canvas rendering 
Canvas approach with drawImage avoids broken-img alt-text issue
and renders JPEG frames correctly. Added minHeight to container.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-11 09:40:11 +02:00
Simon Grüssing
0a8b186585 Add Remote Desktop (JPEG-over-WebSocket), Agent v2.2.0 
- RtcService.cs: Screen capture via Graphics.CopyFromScreen, ~8fps JPEG stream over WebSocket
- shellServer.js: Separate rdp-agent/rdp types with independent socket maps (no shell collision)
- AgentDetailPage: WebSocket-based RemoteDesktop component replaces WebRTC attempt
- setup.iss: Fixed filename to include 'v' prefix (IT-Nexus-Agent-Setup-v2.2.0.exe)
- Removed SIPSorcery dependencies, added System.Drawing.Common

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-10 14:13:18 +02:00
Simon Grüssing
c23091fa6e Add: Agent v2.1.2, WebSocket Live Shell, WebRTC Remote Desktop (Beta), Announcement Push 
- Agent v2.1.2: WebSocket ShellService, ACK nach WS-Ankündigungen, shown_announcements Fix
- Backend: shellServer.js mit WebSocket-Server (Shell + Announcement Push + RTC Signaling)
- Backend: patch.controller.js Fix (command_id=0 Falsy-Bug beim Auto-Update)
- Frontend: Remote Desktop Tab (WebRTC Beta) in AgentDetailPage für super_admin/admin
- Frontend: PatchManagementPage auf v2.1.2 aktualisiert
- WPF Notification: AllowsTransparency=False + kein DropShadowEffect (Dispatcher-Crash Fix)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-10 13:31:11 +02:00
Simon Grüssing
8023765e6c Initial commit: IT Nexus Web-App 2026-06-01 20:49:07 +02:00