Repository navigation
Security: eMudhra CA compromise audit runbook - #1031
Closed
ClintThomson wants to merge 101 commits into
Closed
ClintThomson wants to merge 101 commits into
ClintThomson wants to merge 101 commits into
Conversation
…l versioning Ports the Manage365 brand from the Celeratec/CIPP fork onto the monorepo: cerulean palette + Material Design light/dark themes, Manage365 logo and favicon set, app titles/manifest, dual version tracking (manage365-version.json v6.0.0 / upstream baseline 10.8.5) with the fork's version properties card, GetVersion CleanupStale support, branding default colour #007BA7, and product docs (README/PRODUCT/DESIGN).
Sweep of 691 fork-modified files (reconciled at upstream 10.8.5), 128 fork-only endpoints/helpers/standards placed into CIPPHTTP/CIPPCore/ CIPPStandards/CIPPActivityTriggers, Sherweb extension removal, config merges (standards.json, SAMManifest, IntegrationTemplates), Craft adaptations (orchestrator bridge, UserPhotos byte fetch), Pester tests and feature docs. All PowerShell parses clean.
Sweep of 418 fork-modified files (card views, mobile responsiveness, detail pages, quarantine UI, action categories), 93 fork-only pages/components from the porting pass (SharePoint/OneDrive tools, cross-tenant access, Dynamics, eDiscovery, Teams voice, guest lifecycle), organized navigation merged with monorepo-only entries (container management, authentication, HVE, enrollment profiles), standards.json synced with backend (207 entries incl. 9 cross-tenant standards), Sherweb pages and dead template sections removed. Kept monorepo versions of the auth flow, onboarding wizard, super-admin pages, and the refactored PDF/report suite. Build green, 406 pages.
…ions of 4 diverged entries)
…latent fork syntax error)
Keep the v1 feature catalog as the guide, mark this repo as the v2 monorepo/container successor, and drop leftover SWA/Function App language.
Remove sponsor/community bots, legacy KelvinTegelaar sync, nightly/dev image builds, and the PR check that auto-closes PRs to main. Ungate tests and scans so they run on Celeratec, and point JSON validation at frontend/ paths.
Bring Manage365 through the 10.9 mobile, role, and report-sync updates while keeping branding, the EXO quarantine portal, and standards behavior.
Take the self-host container migration, Graph message trace, and JIT/PIM updates while keeping Manage365 cards, quarantine, and standards.
Take Security Simulations and the 11.0 baseline work while leaving the Baselines flag off so existing standards keep running.
Delegated assignLicense still fails when the operator is not a License Administrator, and inbox-rule work on the older remediate buttons still runs inside the web request.
Pages still imported layouts/index.js and the old drift helper after those files moved to jsx, and Finder duplicates committed in the 10.9 merge were compiled as extra routes.
…65 v6.1.0 across deployment scripts
Align the stale fork implementations with the CIPP 11.0.2 tests, drop the Finder duplicate copies, and fix the frontend checks that were still red.
The table toolbar crashed on undefined handlers, and the committed OpenAPI spec still typed CleanupStale as a string.
…on PR 1 Preset filters, device-code restart, and the phone layouts were lost in the 11.0.2 merge, so the vitest shards stayed red after the last push.
…s sheet The mounted query editor writes a preset's id and name onto its params, and the page-actions story was matching a hidden sheet from the story before it.
Align Manage365 to CIPP 11.0.2
Bumps the npm_and_yarn group with 1 update in the /frontend directory: [sharp](https://github.com/lovell/sharp). Updates `sharp` from 0.35.4 to 0.35.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.4...v0.35.5) --- updated-dependencies: - dependency-name: sharp dependency-version: 0.35.5 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
A v6.1.0 GitHub release would stamp APP_VERSION as 6.1.0. This dispatch builds the linux/amd64 image with baseline 11.0.2 and tag v6.1.0.
Publish the Manage365 v6.1.0 image from main
The auth methods card referenced UsersIcon without the icon registry, so the dashboard threw on load. The empty service worker fetch listener is removed. The image tag moves to v6.1.1 while the upstream baseline stays 11.0.2.
The settings section was listed twice and the sponsor panel was back in the navigation. Client-facing CIPP labels now say Manage365, and the user row menu no longer crashes on a missing role permission. This ships as 6.1.2 with the upstream baseline still at 11.0.2.
Manage365's was inserted into a single-quoted string, so the production image build failed to compile.
Restore the dashboard and ship Manage365 6.1.1
Bring in the post-11.0.2 standards, JIT approval, NinjaOne, and MCP default-on, and replace the oval logo with light and dark wordmarks.
Ship Manage365 6.1.3
… updates. The CIPP baseline stays 11.0.2 so the out-of-date check does not treat this release as an upstream version.
Ship Manage365 6.1.12
A GET of that method comes back 400, which blocked the list, the summary, and the empty confirmation.
Read the site recycle bin with POST
SharePoint treats an empty pagingInfo as an invalid search position and throws ArgumentOutOfRangeException.
Omit empty recycle-bin pagingInfo
SharePoint binds GetRecycleBinItems by position, and pagingInfo is first, so the row limit was being read as the search position. The first page now sends null and orderBy=0.
Pass a null recycle-bin search position
Force prosemirror-view 1.42.3 and follow-redirects 1.16.1, and move the dev-only Vite and source-map-js copies onto their patched releases.
Patch the open runtime dependency alerts
ListEmptySiteRecycleBinStatus failed because the running Craft bridge has GetRun and GetRuns, not GetRunStatus. The status is mapped back onto the queue fields the page already reads.
Read Craft queue status with GetRun
# Conflicts: # .github/copilot-instructions.md # backend/Config/SAMManifest.json # backend/Config/openapi.json # backend/Config/standards.json # backend/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BEC/Push-BECRun.ps1 # backend/Modules/CIPPCore/Public/Authentication/Initialize-CippRequestContext.ps1 # backend/Modules/CIPPCore/Public/CippQueue/ConvertFrom-CIPPCraftRunStatus.ps1 # backend/Modules/CIPPCore/Public/CippQueue/Get-CIPPQueueData.ps1 # backend/Modules/CIPPCore/Public/Get-CIPPJITAdminApprovalRequirement.ps1 # backend/Modules/CIPPCore/Public/GraphHelper/Write-LogMessage.ps1 # backend/Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1 # backend/Modules/CIPPCore/Public/Send-CIPPJITAdminApprovalNotification.ps1 # backend/Modules/CIPPCore/Public/Set-CIPPUserJITAdmin.ps1 # backend/Modules/CIPPCore/Public/Set-CIPPUserLicense.ps1 # backend/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCopilotUsageUserDetail.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecEditTemplate.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSAMCertificate.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetCippAlerts.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionMapping.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionTest.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecJITAdminSettings.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRestoreBackup.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRunBackup.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecEditCalendarPermissions.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecHideFromGAL.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecMailboxMobileDevices.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyCalPerms.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyContactPerms.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecModifyMBPerms.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxQuota.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Resources/Invoke-EditRoomList.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddTenantAllowBlockList.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecQuarantineManagement.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-AddGroupTemplate.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECCheck.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserPhoto.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecEmptySiteRecycleBin.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecTeamsVoicePhoneNumberAssignment.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteRecycleBin.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteRecycleBinSummary.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-AddTestReport.ps1 # backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_1.ps1 # backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_10.ps1 # backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_8.ps1 # backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_5_1_6_1.ps1 # backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_8_1_1.ps1 # backend/Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady003.ps1 # backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneOrgMapping.ps1 # backend/Modules/HuduAPI/2.4.9/HuduAPI.psm1 # backend/Tests/ActivityTriggers/Push-BECRun.Tests.ps1 # backend/Tests/Baselines/BaselineCreateSharedMailbox.Tests.ps1 # backend/Tests/Baselines/BaselineExchangeBatch.Tests.ps1 # backend/Tests/Baselines/BaselineGlobalSecureAccess.Tests.ps1 # backend/Tests/Baselines/BaselineOddballs.Tests.ps1 # backend/Tests/Baselines/Invoke-CIPPBaselineGraduation.Tests.ps1 # backend/Tests/Baselines/TeamsGlobalMeetingPolicy.ExternalBots.Tests.ps1 # backend/Tests/Endpoint/Invoke-ExecBECCheck.Tests.ps1 # backend/Tests/Endpoint/Invoke-ExecJITAdmin.Tests.ps1 # backend/Tests/Private/ConvertFrom-CIPPCraftRunStatus.Tests.ps1 # backend/Tests/Private/Get-CIPPJITAdminApprovalRequirement.Tests.ps1 # backend/Tests/Private/Set-CIPPUserJITAdmin.Approval.Tests.ps1 # backend/Tests/Private/Set-CIPPUserLicense.Tests.ps1 # backend/version_latest.txt # docs/user-documentation/cipp/integrations/cipp-api.md # docs/user-documentation/cipp/settings/README.md # docs/user-documentation/identity/administration/jit-admin/add.md # docs/user-documentation/identity/administration/jit-admin/requests.md # docs/user-documentation/identity/administration/users/README.md # frontend/src/api/ApiCall.jsx # frontend/src/components/CippComponents/CippApiDialog.jsx # frontend/src/components/CippComponents/CippExchangeActions.jsx # frontend/src/components/CippComponents/CippFormCondition.jsx # frontend/src/components/CippComponents/CippMultiQueueTracker.jsx # frontend/src/components/CippIntegrations/CippApiClientManagement.jsx # frontend/src/components/CippIntegrations/CippIntegrationTenantMapping.jsx # frontend/src/components/CippSettings/CippJitAdminSettings.jsx # frontend/src/components/CippTable/CippQueueTracker.jsx # frontend/src/components/CippWizard/CippWizardOffboarding.jsx # frontend/src/data/standards.json # frontend/src/layouts/config.jsx # frontend/src/pages/endpoint/MEM/list-templates/edit.jsx # frontend/src/pages/endpoint/MEM/list-templates/index.jsx # frontend/src/pages/identity/administration/jit-admin/templates/index.jsx # frontend/src/pages/identity/administration/users/index.jsx # frontend/src/pages/teams-share/sharepoint/index.jsx # frontend/src/utils/route-redirects.js # frontend/yarn.lock
# Conflicts: # .github/workflows/CodeQL_Analyser.yml # .github/workflows/Label_Issues.yml # backend/Config/openapi.json # backend/Modules/CIPPCore/Public/AuditLogs/New-CIPPAuditLogSearchResultsCache.ps1 # backend/Modules/CIPPCore/Public/BEC/Get-CIPPBecSignInBaseline.ps1 # backend/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-AuditLogSearchCreation.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecListBackup.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecSAMCredentials.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListApps.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeams.ps1 # backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsActivity.ps1 # backend/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_4.ps1 # backend/Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21816.ps1 # backend/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneTenantSync.ps1 # backend/Tests/Endpoint/Invoke-ExecBECCheck.Tests.ps1 # backend/Tests/Private/BecIPCollectors.Tests.ps1 # backend/Tests/Private/Invoke-CIPPBecIPAnalysis.Tests.ps1 # frontend/src/components/CippComponents/CippApiDialog.jsx # frontend/src/components/CippComponents/CippIntuneDeviceActions.jsx # frontend/src/components/CippSettings/CippSAMCredentials.jsx # frontend/src/components/CippTable/CippDataTable.jsx # frontend/src/components/CippWizard/CippCertificateAuthStep.jsx # frontend/src/data/AuditLogSchema.json # frontend/src/layouts/config.jsx # frontend/src/layouts/side-nav-item.jsx # frontend/src/layouts/side-nav.jsx # frontend/src/pages/cipp/advanced/authentication/sam-app-permissions.jsx # frontend/src/pages/cipp/logs/index.jsx # frontend/src/pages/email/administration/mailbox-rules/index.jsx # frontend/src/pages/email/administration/tenant-allow-block-lists/index.jsx # frontend/src/pages/email/reports/calendar-permissions/index.jsx # frontend/src/pages/email/reports/mailbox-forwarding/index.jsx # frontend/src/pages/endpoint/applications/list/index.jsx # frontend/src/pages/teams-share/onedrive/index.jsx # frontend/src/pages/teams-share/sharepoint/index.jsx # frontend/src/pages/teams-share/teams/business-voice/index.jsx # frontend/src/pages/tenant/administration/add-subscription/index.jsx # frontend/src/pages/tools/custom-tests/index.jsx # frontend/yarn.lock
Keep action-dialog link checks and the Teams phone-number prefix that the absorb had dropped.
Absorb CIPP 11.2.1 as Manage365 6.1.17
Allow PIM and JIT Admin assignments up to 365 days instead of pre-capping them to the tenant policy.
release: Manage365 6.1.18
Consent an application for named users with a Principal grant instead of tenant-wide admin consent.
release: Manage365 6.1.19
Close a consent request CIPP cannot review without granting admin consent.
release: Manage365 6.1.20
Record a consent decision on the approval step, and accept AppId from the request body.
release: Manage365 6.1.21
Align engines, Docker frontend build stages, dev compose, CI, and .nvmrc so build-time Node is on a patched 22.x release.
Merge security/node-cve-2026-111497, bump version metadata, pin Validate JSON CI to engines.node, and update deployment defaults for v6.1.22.
Documents Manage365 TLS exposure and gives operators a read-only probe for local trust stores without changing production deploy paths.
Contributor
|
🔄 If you are attempting to update your CIPP repo please follow the instructions at: https://docs.cipp.app/setup/self-hosting-guide/updating. Are you a subscriber? Contact the helpdesk for direct assistance with updating to the latest version. It looks like you may already have a pending update PR on your fork — check your open pull requests to accept it. 🔒 This PR will now be automatically closed due to the above rules. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
docs/security/emudhra-ca-incident-2026.mdwith Manage365-specific audit results (no owned certs chain to eMudhra; no pinned CA bundles in repo).scripts/security/Test-EmudhraTrustStores.ps1to check probe hosts and production TLS issuers on a workstation or agent.Audit highlights (2026-10-23)
manage365.celeratec.cloud: DigiCert GeoTrust (Azure managed cert, thumbprint ending …66251).Test plan
./scripts/security/Test-EmudhraTrustStores.ps1on macOS and Ubuntu dev/CI machines.curlon macOS (/etc/ssl/cert.pem).