mescon/Muximux v3.4.1

on GitHub

A security release. Every 3.x install with non-admin accounts should update:
a signed-in user could read any app's administrative fields through the
single-app endpoint. No configuration changes; drop-in.

Security

• A non-admin user could read any app's full configuration. GET /api/app/{name} used the administrative projection for every caller and
  skipped the visibility rules the list endpoint applies, so any signed-in
  user could retrieve proxy_headers, http_action_headers,
  docker_endpoint and credentials embedded in an app's URL, and could
  fetch apps hidden from them by min_role or allowed_groups. The
  endpoint now projects for the caller's role through the same rule as
  /api/apps and answers 404 for anything the caller could not list.
  Reported privately by zjh777. (GHSA-44h2-562r-3m67)
• A base_path beginning with // can no longer turn the trailing-slash
  redirect into an open redirect. Only an administrator could set one, so
  this was a hardening rather than an exposure. base_path is now validated
  at load (no leading //, backslashes, dot segments, whitespace, ? or
  #) and the normaliser collapses leading slashes regardless.