3 commits

Author	SHA1	Message	Date
Henrique Dias	883a36f02f	fix(auth): reject signup when normalized home dir collides (GHSA-7rc3-g7h6-22m7) ... cleanUsername is many-to-one, so distinct usernames (e.g. "teamone/x" and "teamone-x") can normalize to the same home directory. With CreateUserDir enabled, the second registrant silently reused the first user's directory, breaking per-user isolation. Add a GetByScope lookup and reject a signup whose derived scope is already taken. The check is gated on CreateUserDir: when it is off, signups intentionally share the configured default scope. Adds a regression test for the colliding-username case.	2026-06-27 09:08:56 +02:00
Henrique Dias	a1063925e1	fix: restore symlink behavior as opt-in followExternalSymlinks	2026-06-23 13:19:51 +02:00
kodareef5	f13c7c8cff	fix: restrict default permissions for proxy-auth auto-provisioned users (#5890) ... Co-authored-by: Henrique Dias <mail@hacdias.com>	2026-04-04 22:02:34 +02:00