3 Commits

Include renames

Author	SHA1	Message	Date
root	72382c43d0	fix: guide link IDOR, full team-api IDOR hardening, loading overlay ... - guide link now server-side replaced to /team/<idx>/guide (no /team/0 403) - _check_team_host() applied to ALL team endpoints (login, info, targets, status, guide, portal, ssh-ws): host must match team domain; panel/gemastik host only with admin session. Cross-domain session reuse -> 403. - host check BEFORE auth on info/targets (no team-existence oracle) - loading overlay (spinner + text) on start/stop all-team/set; JS util showLoading/hideLoading	2026-09-23 17:02:52 +08:00
root	43ed3df557	feat: team portal with own login, SSH web terminal, targets & guide ... - Portal tim punya login sendiri (password = ssh_pass, session team_token) - SSH Web GUI: /api/team/{idx}/ssh/ws (WebSocket+paramiko) → xterm.js terminal (fix: ssh_to_ws non-blocking poll, chall_passwords per-container auth) - Root <slug>.gemastik.imrnes.team → portal tim (bukan login admin) - Host validation: /team/{idx} & /team/{idx}/guide 403 kalau host != team domain - /api/team/{idx}/targets: daftar service tim musuh (attack target) - guide.html: panduan SSH/attack/defense untuk peserta - fix esc() String(s) (bug: (s||'').replace is not a function saat port number) - set_ssh_passwords retry loop (container boot race)	2026-09-23 16:37:58 +08:00
root	5e44a70049	feat: team-specific subdomains + portal tim ... - create_team now takes label -> slug -> <slug>.gemastik.imrnes.team - ensure_team_domains() writes Traefik dynamic config (gemastik-teams.yaml) - team portal at /team/<idx> (public, shows chall ports, SSH, submit form) - /api/team/<idx>/info + /api/team/<idx>/status (server-side receiver auth) - UI: name inputs per team (set count -> labels), domain link in card - delete team endpoint drops its domain	2026-09-23 16:18:11 +08:00