github-starred/actual
2
0
Fork 0
mirror of https://github.com/actualbudget/actual.git synced 2026-04-28 18:40:34 -05:00
Code Issues 1.3k Packages Projects Releases 54 Wiki Activity

Fix: restrict electron-embedded sync server to bind only to configured hostname for security (#5050)

Browse Source 
* comment sync server

* Fix: ensure electron-embedded sync server binds to localhost to limit access

* lint and release notes

* rename

* remove hostname config and revert docker yaml
This commit is contained in:
Shreyas
2025-05-27 11:57:06 -04:00
committed by GitHub
parent 7d38f6934d
commit d2d8ce2353
2 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
packages/desktop-electron/index.ts
View File

@@ -219,6 +219,7 @@ async function startSyncServer() {
const syncServerConfig = {
port: globalPrefs.syncServerConfig?.port || 5007,
hostname: 'localhost',
ACTUAL_SERVER_DATA_DIR: path.resolve(
process.env.ACTUAL_DATA_DIR!,
'actual-server',
@@ -252,6 +253,7 @@ async function startSyncServer() {
const envVariables: Env = {
...process.env, // required
ACTUAL_PORT: `${syncServerConfig.port}`,
ACTUAL_HOSTNAME: `${syncServerConfig.hostname}`,
ACTUAL_SERVER_FILES: `${syncServerConfig.ACTUAL_SERVER_FILES}`,
ACTUAL_USER_FILES: `${syncServerConfig.ACTUAL_USER_FILES}`,
ACTUAL_DATA_DIR: `${syncServerConfig.ACTUAL_SERVER_DATA_DIR}`,

6
upcoming-release-notes/5050.md Normal file
View File

@@ -0,0 +1,6 @@
---
category: Bugfix
authors: [ShreyasKallingal]
---
Restrict Electron-embedded sync server to bind only to configured hostname.