GO-2025-3834: 1Panel agent certificate verification bypass leading to arbitrary command execution in github.com/1Panel-dev/1Panel/core

auth

package

v0.0.0-...-4c26945 Latest Latest Go to latest Published: Apr 2, 2026 License: GPL-3.0 Imports: 4 Imported by: 0

Details

View Source

const (
	MaxIPCount        = 100
	ExpireDuration    = 30 * time.Minute
	MaxFailedAttempts = 10
	LockDuration      = 5 * time.Minute
)

View Source

const (
	MFASessionTTL             = 5 * time.Minute
	MFASessionStoreMaxEntries = 1024
	MFASessionMaxFailures     = 5
)

This section is empty.

func GetMFASessionStore() *mfaSessionStore

type IPRecord struct {
	NeedCaptcha bool
	FailedCount int
	LockedUntil time.Time
	LastUpdate  time.Time
}

type IPTracker struct {
	// contains filtered or unexported fields
}

func NewIPTracker() *IPTracker

func (t *IPTracker) Clear(ip string)

func (t *IPTracker) IsLocked(ip string) bool

func (t *IPTracker) NeedCaptcha(ip string) bool

func (t *IPTracker) RecordFailure(ip string)

func (t *IPTracker) SetNeedCaptcha(ip string)