6b9c7cf4ae
Fix path traversal, auth-bypass, and DoS findings from the security review
...
- Add ValidateFileName (allowlist regex, rejects .. and separators) and apply
it to every route that concatenates a raw path segment into a filesystem or
remote FTP path: /show/lvgmc-forecast, /show/grib, /grib/binary-chunk, and
/debug/file. Previously an unauthenticated caller could read arbitrary
files, including /proc/self/environ (leaks LVGMC_PASSWORD/POSTGRES_PASSWORD).
- Harden ValidateInt to reject negative integers.
- Gate /api/fetch/lvgmc/stations behind ENABLE_LVGMC_FTP_JOBS so it can no
longer trigger a real, unauthenticated FTP login regardless of the flag;
stop leaking error.getMessage in its response.
- Add an explicit /api/* catch-all (NotFound) so an unmatched API route can
never fall through to the SPA fallback and be served index.html as a 200.
- Cap binary-chunk read length at 64MB to prevent an unbounded allocation.
2026-08-24 11:50:53 +03:00
b0b58d2f1e
Keep a missing /assets file a real 404 in the SPA fallback
...
A stale browser tab referencing a bundle removed by a later deploy
should get a clean 404, not HTML served where JS was expected.
2026-08-24 10:35:34 +03:00
2c4488846e
Add a general SPA fallback instead of an explicit per-route list
...
Direct hits on client-side routes not in the hardcoded list (e.g. a
browser refresh on /faktiska or /udens-temperatura) 404ed instead of
loading the app — a known limitation that was actually hit in
production. Real files now serve as-is; anything else falls back to
index.html so the SolidJS router handles it, matching the existing
"TODO rewrite in more generic way" comment. Future routes need no
backend changes.
2026-08-24 10:32:38 +03:00
4036d2477f
Add real-time water temperature backend (Ūdens), fetch-on-demand like warnings
2026-08-23 11:15:33 +03:00
39fcb3ed6b
Remove the dead METEO_* fetch path
...
Confirmed via git history it's not a separate vendor: the very first
commit (2023-04-13) included real sample CSVs from it with a Latvian
header identical to the LVGMC/open-data fields — same underlying LVĢMC
data, just an earlier delivery mechanism superseded by the FTP feed and
never removed. Never wired into anything that runs (Server.scala's
import was already commented out).
2026-08-23 10:49:26 +03:00
bc5bee171c
Add LVGMC warning map workflow
2026-08-22 20:11:20 +03:00
f3197bf340
Return API responses as JSON
2026-08-22 14:22:15 +03:00
e726291bdb
Build fixed Faktiska production workflow
2026-08-19 17:11:58 +03:00
9ab4cfe3fe
Changed api to fetch manually only most recent files
2025-11-04 22:58:53 +02:00
b44364d9a6
Write fatal errors to logs, view logs, clear tmp folder
2025-03-16 15:38:11 +02:00
329776b67f
Move debug logic from server to separate file
2025-03-16 13:33:52 +02:00
841b4b6ec9
Getting lvgmc csv files in frontend
2025-03-10 16:56:24 +02:00
52180544e9
Add debugging rest methods for folders and time
2025-03-06 00:00:21 +02:00
e9408391ac
Rest api for deleting old forecasts
2025-03-05 23:25:42 +02:00
0b221bcfee
Download structure for all files in one go. For better UX
2025-02-14 20:26:57 +02:00
15cfbd1801
Refactor to one scheduler, separated csv/grib under one folder
2025-02-14 14:46:31 +02:00
3b8bb7d826
Hacky way to hardcode routes for spa
2025-02-14 12:58:19 +02:00
dc82b95a8a
Fix paths in docker images
2025-02-13 23:21:19 +02:00
37ac7eb0e3
Fix deployment for fly.io
2025-02-13 16:11:50 +02:00
df8d16ed4a
Fetch binary chunk and draw on canvas
2025-02-03 23:33:28 +02:00
ae4080103f
Server responses for grib list and grib structure
2025-02-01 23:14:20 +02:00
cb662e5f53
Add mapping of meteo discipline, category, product
2025-01-31 14:56:59 +02:00
65dfcf052a
Query and display city field chart and all city weather data
2024-01-12 17:13:39 +02:00
a48b9df91f
Query and display weather data for all country
2023-12-24 23:54:16 +02:00
2aa6c5f43c
Cleanup fileservice and dataservice
2023-12-17 22:48:24 +02:00
3a1f0ac726
First version of querying data from postgres
2023-12-15 13:49:07 +02:00
eaf2788031
Move queries in file manager to postgres
2023-12-12 15:36:30 +02:00
51ed1e2c7a
Improving insert queries for postgres
2023-12-11 00:12:52 +02:00
8f2ade2fcf
Fix parsing db url, remove 24h state, add db saving
2023-12-10 20:37:53 +02:00
f1e68c6dba
Limit all dates asking to 3 months range
2023-08-11 16:22:15 +03:00
b887317c6b
Server returns query data, bar chart, styling charts
2023-08-03 00:03:48 +03:00
c5b84727a6
Add granularity for aggregation, group by hour/day/month/year
2023-07-03 23:17:43 +03:00
3e1635d494
Refactor save return type without Either
2023-06-22 13:59:44 +03:00
be037a311d
Remove StatefulFetchService as we have already DataService with lst 24h state
2023-05-25 11:53:32 +03:00
f5e4826b88
DataService to save last 24h of data
2023-05-25 01:46:50 +03:00
d40aa9ec9b
StatefulFetchService to save last 24h of data
2023-05-25 00:06:20 +03:00
760ef4e719
Dependency inject logger and replace println
2023-05-21 22:37:33 +03:00
8b3f97bb96
Fix duplications of data, sort query list, visual improvements
2023-05-21 13:26:17 +03:00
bbdfaa06d8
DBService object to class with logger injection
2023-05-20 20:20:14 +03:00
ff3efdfb58
Fetch csv files from date range input and use setTimeout
2023-05-17 16:28:56 +03:00
affc2e0d93
Migrate from Blaze to Ember
2023-05-17 01:20:01 +03:00
590757183a
Use pureconfig instead of typesafe config
2023-05-16 14:54:02 +03:00
db900d6a33
File manager frontend
2023-05-15 16:37:03 +03:00
851229ce9b
Set up cors and env variables
2023-05-14 23:01:36 +03:00
bbf1eb0c01
Blaze serves also static index.html and bundle.js
2023-05-14 21:27:57 +03:00
6ca1f4a13a
Scheduler and also Main file to call server and scheduler
2023-05-14 15:48:52 +03:00
7cb6349ac7
Configure fly.io and docker
2023-05-12 23:57:04 +03:00
0227ac3b43
Improve help json response
2023-05-03 22:37:05 +03:00
9fbc6f9f37
Changed data structure for weather params and aggregating
2023-05-03 00:02:59 +03:00
7e3d58bec0
Add conf into IO and handle IO throwable
2023-05-01 16:43:21 +03:00
b0txec