gitea 539c33f511 fix: isWhitelisted() reads only jail.local — single source of truth ...

Previously isWhitelisted() checked SUBNETS_TO_IGNORE env var in addition
to jail.local ignoreip. This meant removing a subnet from the dashboard
whitelist updated fail2ban but the dashboard scan still excluded those IPs,
creating a visible disconnect.

Now isWhitelisted() reads and does CIDR matching only against jail.local.
Dashboard whitelist changes are immediately reflected in scan/records,
1:1 with what fail2ban enforces.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-02-20 18:11:35 +00:00

19 KiB

Raw Blame History

View Raw