Venkatesh Panda b01a31c635 caddyauth: Don't write into shared hash buffer when building cache key (#8278) ...

HTTPBasicAuth.correctPassword built its hash cache key with
append(account.password, plaintextPassword...). account.password is
shared by all requests and can have spare capacity, so short passwords
were written into the stored hash's backing array, causing a data race
between concurrent requests and potentially mixed-up cache keys.

Build the key in a fresh buffer instead, and add regression tests.

(cherry picked from commit f89626aa55)

2026-11-03 18:25:44 -05:00

..

caddyevents

events: tell CertMagic which events are worth emitting (#8010)

2026-10-03 01:03:20 +10:00

caddyfs

events: Refactor; move Event into core, so core can emit events (#6930)

2025-03-29 08:15:43 -06:00

caddyhttp

caddyauth: Don't write into shared hash buffer when building cache key (#8278)

2026-11-03 18:25:44 -05:00

caddypki

acmeserver: say when the CA database is locked by another process (#8007)

2026-09-11 14:49:31 +10:00

caddytls

caddytls: keep ACME issuer network proxy after RebuildCertMagic (#8288)

2026-11-03 00:53:19 -05:00

filestorage

caddyfile: Normalize & flatten all unmarshalers (#6037)

2024-01-23 19:36:59 -05:00

internal/network

network_proxy: reject proxy URLs that resolve to a port with no host (#7922)

2026-08-10 15:58:43 +10:00

logging

logging: Parse request URIs in the query filter like the server does (#8255)

2026-11-03 00:53:19 -05:00

metrics

metrics: scope metrics to active config, add optional per-host metrics (#6531)

2024-10-02 08:23:26 -06:00

standard

filesystem: Globally declared filesystems, fs directive (#5833)

2024-01-13 20:12:43 +00:00