T

root 72382c43d0 fix: guide link IDOR, full team-api IDOR hardening, loading overlay

- guide link now server-side replaced to /team/<idx>/guide (no /team/0 403)
- _check_team_host() applied to ALL team endpoints (login, info, targets,
  status, guide, portal, ssh-ws): host must match team domain; panel/gemastik
  host only with admin session. Cross-domain session reuse -> 403.
- host check BEFORE auth on info/targets (no team-existence oracle)
- loading overlay (spinner + text) on start/stop all-team/set; JS util
  showLoading/hideLoading

2026-09-23 17:02:52 +08:00

panel

fix: guide link IDOR, full team-api IDOR hardening, loading overlay

2026-09-23 17:02:52 +08:00

receiver

chore: gitignore runtime flags + leaderboard

2026-09-23 16:18:59 +08:00

services

fix: use bookworm base for blogpost; route receiver history via :18080

2026-09-23 13:54:46 +08:00

utils

fix: use bookworm base for blogpost; route receiver history via :18080