From 4db93d7572c3ec07bd6f7584a3cd1adac29fd05f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 26 May 2026 08:33:52 +0000 Subject: [PATCH 1/6] Harden trust proxy and Excel exports Agent-Logs-Url: https://github.com/jamesjhs/Tasker/sessions/0d3e6b03-297c-4119-8d17-3add73d86fff Co-authored-by: jamesjhs <168957462+jamesjhs@users.noreply.github.com> --- .env.example | 5 +++++ docs/installation.md | 6 +++-- docs/technical-manual.html | 9 ++++---- package-lock.json | 4 ++-- package.json | 2 +- src/routes/analytics.ts | 46 ++++++++++++++++++++++++++------------ src/server.ts | 16 ++++++++++++- 7 files changed, 64 insertions(+), 24 deletions(-) diff --git a/.env.example b/.env.example index 933aee2..33ed6c8 100644 --- a/.env.example +++ b/.env.example @@ -20,6 +20,11 @@ USE_HTTPS=false # SSL_CERT=/etc/letsencrypt/live/example.com/fullchain.pem # SSL_KEY=/etc/letsencrypt/live/example.com/privkey.pem +# Express trust proxy configuration. Leave empty when running Tasker directly on +# the internet. Set to true (or a hop count like 1) when behind a reverse proxy. +# Accepts true/false, a hop count, or a proxy-addr value such as "loopback". +# TRUST_PROXY=true + # SMTP email settings (optional — can also be configured via the admin panel). # Used to email dropdown/flag suggestions to the administrator instead of # storing free-text user input on the server. diff --git a/docs/installation.md b/docs/installation.md index 161101f..e9486a2 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -1,6 +1,6 @@ # Tasker — Installation Manual -**Version 1.14.0 — May 2026** +**Version 1.14.1 — May 2026** --- @@ -99,6 +99,7 @@ nano .env # or use your preferred editor | `PORT` | Port the application listens on | `3020` | | `SESSION_SECRET` | A long, random secret string used to sign session cookies. **Must be set in production.** | Random (changes on every restart) | | `NODE_ENV` | Set to `production` to enable secure (HTTPS-only) cookies | — | +| `TRUST_PROXY` | Express trust proxy setting. Leave empty when Tasker is directly exposed. Set to `true` or a hop count (e.g. `1`) when behind a reverse proxy so `X-Forwarded-For` and scheme headers are trusted. | — | | `APP_URL` | Full public URL of the server (no trailing slash). Used to generate clickable review links in suggestion emails, plus canonical and crawler-facing URLs for the homepage, llms.txt, robots.txt, and sitemap.xml. | — | | `SSL_CERT_DIR` | Directory containing Let's Encrypt certificate files | `/etc/letsencrypt/live/yourdomain` | | `SSL_CERT` | Full path to the certificate chain file | `$SSL_CERT_DIR/fullchain.pem` | @@ -120,6 +121,7 @@ Copy the output into your `.env` file as the `SESSION_SECRET` value. PORT=3020 SESSION_SECRET= NODE_ENV=production +TRUST_PROXY=1 APP_URL=https://tasker.jahosi.co.uk SSL_CERT_DIR=/etc/letsencrypt/live/yourdomain.example.com ``` @@ -285,7 +287,7 @@ The server detects SSL certificates automatically. If both `SSL_CERT` and `SSL_K ### Running behind a reverse proxy (HTTP internally) -If you terminate SSL at Nginx or Caddy and forward plain HTTP to Tasker, **do not** set `SSL_CERT` / `SSL_KEY` in `.env`. The application will listen on plain HTTP internally. The `trust proxy` setting is already configured so that `X-Forwarded-For` headers are respected. +If you terminate SSL at Nginx or Caddy and forward plain HTTP to Tasker, **do not** set `SSL_CERT` / `SSL_KEY` in `.env`. The application will listen on plain HTTP internally. Set `TRUST_PROXY=1` (or `true`) so that `X-Forwarded-For` and scheme headers are respected by Express. --- diff --git a/docs/technical-manual.html b/docs/technical-manual.html index 3742585..e4a3181 100644 --- a/docs/technical-manual.html +++ b/docs/technical-manual.html @@ -3,7 +3,7 @@ - Tasker — Technical Reference Manual v1.14.0 + Tasker — Technical Reference Manual v1.14.1 - ← Back + ← Back

🛡️ Tasker — Data Protection Impact Assessment (DPIA)

Version 1.14.0 — Completed 23 May 2026  |  Application Version 1.14.0  |  Prepared in accordance with UK GDPR Article 35 and ICO guidance

diff --git a/public/guide.html b/public/guide.html index e998c6a..bbbafa6 100644 --- a/public/guide.html +++ b/public/guide.html @@ -362,7 +362,7 @@
📱

Tasker Quick Start Guide

Everything you need to start recording tasks in under 5 minutes.

- ← Back to Tasker + ← Back to Tasker
@@ -893,7 +893,7 @@

Tasker Quick Start Guide

 ·  Data & Use Policy  ·  - ← Back to Tasker + ← Back to Tasker

diff --git a/public/help.html b/public/help.html index 2915992..d1ec1a4 100644 --- a/public/help.html +++ b/public/help.html @@ -28,7 +28,7 @@ - ← Back + ← Back

❓ Tasker — Help & User Guide

Version 1.14.0 — May 2026

diff --git a/public/index.html b/public/index.html index 05e6233..9422256 100644 --- a/public/index.html +++ b/public/index.html @@ -38,7 +38,7 @@ Tasker — Anonymous workload logger for healthcare teams - -