Stefan/evcc-io
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge commit from fork

Browse source 
* Config: require admin password for script plugins

* refactor
This commit is contained in:
Michael Geers 2026-06-24 15:45:15 +02:00 • committed by GitHub
parent a193236395
commit 4c907c5afa
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
17 changed files with 594 additions and 207 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/agents/api-security.md
View file

@ -88,11 +88,21 @@ achieves the same effect (the previous key stops working immediately).
| State / read-only / basic charging control | Public | |
| Set or update admin password | Public | admin password |
| Configuration | Secure | |
| Configuration embedding a script plugin | Critical | api key or admin password |
| System: logs, cache, shutdown | Secure | |
| API key status | Secure | |
| System: backup / restore / reset | Critical | api key or admin password |
| API key regenerate | Critical | admin password |
Device test, create, and update (`/api/config/test/{class}` and `/api/config/devices/{class}`)
instantiate a config immediately, so a `script` plugin in the payload runs a shell command on the
server. Because that command could read credentials a session is not otherwise allowed to see (for
example the contents of the database), these requests are treated as Critical when the config embeds
a script plugin, at any nesting depth. A session caller must supply the admin password in the
`X-Admin-Password` header; an API-key caller passes without it. The `go` (yaegi) and `js` (otto)
plugins are excluded: their interpreters are sandboxed to pure computation and cannot read files,
spawn processes, or open network connections.
**Public** endpoints accept any caller. **Secure** endpoints require a
valid session (cookie or API key). **Critical** endpoints require extra
authentication in the form of an admin password (or, for some, an API