From 07929f2a310f7c693d60a1fd71544bc76d81e76a Mon Sep 17 00:00:00 2001 From: Aigars Silkalns Date: Mon, 20 Oct 2025 13:30:01 +0300 Subject: [PATCH] Addresses security concern --- .gitignore | 1 + README.md | 26 + SECURITY.md | 99 +++ dist/index 2.html | 1502 ++++++++++++++++++++++++++++++++ dist/index2 2.html | 2031 ++++++++++++++++++++++++++++++++++++++++++++ dist/index3 2.html | 1289 ++++++++++++++++++++++++++++ 6 files changed, 4948 insertions(+) create mode 100644 SECURITY.md create mode 100644 dist/index 2.html create mode 100644 dist/index2 2.html create mode 100644 dist/index3 2.html diff --git a/.gitignore b/.gitignore index 6e812573d..fc2e94c9f 100644 --- a/.gitignore +++ b/.gitignore @@ -39,3 +39,4 @@ test.html ad.js /.cache/ CLAUDE.md +github-issue-response.md diff --git a/README.md b/README.md index 9d98ca64f..4bca53f0c 100644 --- a/README.md +++ b/README.md @@ -88,6 +88,32 @@ AdminLTE v4 build scripts work cross-platform: All npm scripts use cross-platform utilities to ensure consistent behavior across different operating systems. +## Security & Production Deployment + +### Important Security Notice + +AdminLTE is a **UI template** - when deploying to production, follow these critical guidelines: + +**What to Deploy:** +- Only compiled production assets: `dist/js/adminlte.min.js` and `dist/css/adminlte.min.css` +- Your application-specific files + +**What NOT to Deploy:** +- `node_modules/` directory +- Demo/example HTML files (index.html, index2.html, index3.html, etc.) +- Source files (`src/` directory) +- Development configuration files + +**CVE-2021-36471 Notice:** +This CVE is **disputed** and does not represent a vulnerability in AdminLTE. It refers to demo pages being accessible when developers incorrectly deploy example files to production. AdminLTE v4 has a clear separation between development demos and production assets. See [SECURITY.md](SECURITY.md) for complete details. + +**Production Build:** +```bash +npm run production # Builds optimized assets in dist/ +``` + +For detailed security guidelines, authentication requirements, and best practices, see [SECURITY.md](SECURITY.md). + ## Sponsorship Support AdminLTE development by becoming a sponsor or donor. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..8bf4807ee --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,99 @@ +# Security Policy + +## Reporting Security Issues + +If you discover a security vulnerability in AdminLTE, please report it by emailing the maintainers or opening a private security advisory on GitHub. We take security seriously and will respond promptly. + +## Supported Versions + +| Version | Supported | +| ------- | ------------------ | +| 4.x | :white_check_mark: | +| 3.x | :x: | +| < 3.0 | :x: | + +## Security Best Practices + +AdminLTE is a frontend admin dashboard template. When deploying applications built with AdminLTE, follow these security best practices: + +### 1. Production Deployment + +- **Never expose `node_modules` directory** in production environments +- **Remove demo/example files** (like `index2.html`, `index3.html`) from production builds +- **Use a proper build process** that only includes necessary production assets +- **Configure web server properly** to prevent directory traversal attacks + +### 2. Build Process + +When deploying to production: + +```bash +# Build only production assets +npm run production + +# Deploy only the dist/ directory contents you need +# Typically: dist/js/adminlte.min.js and dist/css/adminlte.min.css +``` + +### 3. What NOT to Deploy + +Do not deploy these to production: +- `node_modules/` directory +- Example/demo HTML files (`index.html`, `index2.html`, `index3.html`, etc.) +- Source files (`src/` directory) +- Development configuration files +- Documentation files + +## Known CVE Issues + +### CVE-2021-36471 (Disputed) + +**Status**: This CVE is **disputed** and does not represent a vulnerability in AdminLTE itself. + +**Issue**: CVE-2021-36471 claims AdminLTE 3.1.0 has a "Directory Traversal vulnerability" that allows remote attackers to view demo pages via `/admin/index2.html` and `/admin/index3.html`. + +**Clarification**: +- The `index2.html` and `index3.html` files are **example/demo pages** intended for developer reference during development +- This is **not a vulnerability in AdminLTE** - it is a **deployment misconfiguration** by website developers +- The issue occurs when developers incorrectly deploy: + - Their entire `node_modules` folder publicly + - Demo/example files in production environments + - Without proper web server configuration + +**Resolution**: +- AdminLTE 4.x has restructured the project architecture with clear separation between development demos and production assets +- Follow the production deployment best practices above +- Only deploy the compiled production assets from `dist/js/` and `dist/css/` +- The original CVE researcher acknowledged this should be classified as low/info severity, not critical + +**For More Information**: +- [GitHub Issue #4948](https://github.com/ColorlibHQ/AdminLTE/issues/4948) +- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2021-36471) (marked as disputed) + +## Secure Development + +### Content Security Policy (CSP) + +When implementing AdminLTE in your application, consider adding appropriate Content Security Policy headers to prevent XSS attacks. + +### Authentication & Authorization + +AdminLTE is a **UI template only** and does not include authentication or authorization. You must: +- Implement proper authentication in your backend +- Secure all API endpoints +- Use HTTPS in production +- Implement proper session management +- Follow OWASP security guidelines + +### Dependencies + +- Keep AdminLTE and its dependencies up to date +- Regularly run `npm audit` to check for vulnerabilities +- Review security advisories for Bootstrap and other dependencies + +## Contact + +For security concerns, please contact the maintainers through: +- GitHub Issues (for general questions) +- GitHub Security Advisories (for sensitive security issues) +- Project maintainer email (check package.json) diff --git a/dist/index 2.html b/dist/index 2.html new file mode 100644 index 000000000..c5f75487c --- /dev/null +++ b/dist/index 2.html @@ -0,0 +1,1502 @@ + + + + + + AdminLTE v4 | Dashboard + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + + + + + + +
+ +
+ +
+ +
+
+

Dashboard

+
+
+
    +
  1. Home
    2. +
  2. Dashboard
    3. +
+
+
+ +
+ +
+ + +
+ +
+ +
+ +
+ +
+
+

150

+ +

New Orders

+
+ + + More info + +
+ +
+ +
+ +
+
+

53%

+ +

Bounce Rate

+
+ + + More info + +
+ +
+ +
+ +
+
+

44

+ +

User Registrations

+
+ + + More info + +
+ +
+ +
+ +
+
+

65

+ +

Unique Visitors

+
+ + + More info + +
+ +
+ +
+ + +
+ +
+
+
+

Sales Value

+
+ +
+
+
+
+ + + +
+
+

Direct Chat

+ +
+ 3 + + + +
+
+ +
+ +
+ +
+
+ Alexander Pierce + 23 Jan 2:00 pm +
+ + message user image + +
+ Is this template really for free? That's unbelievable! +
+ +
+ + + +
+
+ Sarah Bullock + 23 Jan 2:05 pm +
+ + message user image + +
You better believe it!
+ +
+ + + +
+
+ Alexander Pierce + 23 Jan 5:37 pm +
+ + message user image + +
+ Working with AdminLTE on a great new app! Wanna join? +
+ +
+ + + +
+
+ Sarah Bullock + 23 Jan 6:10 pm +
+ + message user image + +
I would love to.
+ +
+ +
+ + + +
+ + +
+ +
+ +
+
+
+ + + + +
+
+
+ +
+ +
+ + + +
+
+
+

Sales Value

+
+ +
+
+
+
+
+
+ +
+
+
+
Visitors
+
+
+
+
Online
+
+
+
+
Sales
+
+
+ +
+
+
+ +
+ +
+ +
+ +
+ + +
+ +
Anything you want
+ + + + Copyright © 2014-2025  + AdminLTE.io. + + All rights reserved. + +
+ +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/dist/index2 2.html b/dist/index2 2.html new file mode 100644 index 000000000..eebcf0920 --- /dev/null +++ b/dist/index2 2.html @@ -0,0 +1,2031 @@ + + + + + + AdminLTE | Dashboard v2 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + + + + + + +
+ +
+ +
+ +
+
+

Dashboard v2

+
+
+
    +
  1. Home
    2. +
  2. Dashboard v2
    3. +
+
+
+ +
+ +
+
+ +
+ +
+
+
+ + + + +
+ CPU Traffic + + 10 + % + +
+ +
+ +
+ +
+
+ + + + +
+ Likes + 41,410 +
+ +
+ +
+ + + + + +
+
+ + + + +
+ Sales + 760 +
+ +
+ +
+ +
+
+ + + + +
+ New Members + 2,000 +
+ +
+ +
+ +
+ + + +
+
+
+
+
Monthly Recap Report
+ +
+ +
+ + +
+ +
+
+ +
+ +
+
+

+ Sales: 1 Jan, 2023 - 30 Jul, 2023 +

+ +
+
+ +
+

+ Goal Completion +

+ +
+ Add Products to Cart + 160/200 +
+
+
+
+ + +
+ Complete Purchase + 310/400 +
+
+
+
+ + +
+ Visit Premium Page + 480/800 +
+
+
+
+ + +
+ Send Inquiries + 250/500 +
+
+
+
+ +
+ +
+ +
+ +
+ +
+
+
+ + 17% + +
$35,210.43
+ TOTAL REVENUE +
+
+ + +
+
+ 0% +
$10,390.90
+ TOTAL COST +
+
+ +
+
+ + 20% + +
$24,813.53
+ TOTAL PROFIT +
+
+ +
+
+ + 18% + +
1200
+ GOAL COMPLETIONS +
+
+
+ +
+ +
+ +
+ +
+ + + +
+ +
+ +
+
+ +
+
+

Direct Chat

+ +
+ 3 + + + +
+
+ +
+ +
+ +
+
+ Alexander Pierce + 23 Jan 2:00 pm +
+ + message user image + +
+ Is this template really for free? That's unbelievable! +
+ +
+ + + +
+
+ Sarah Bullock + + 23 Jan 2:05 pm + +
+ + message user image + +
You better believe it!
+ +
+ + + +
+
+ Alexander Pierce + 23 Jan 5:37 pm +
+ + message user image + +
+ Working with AdminLTE on a great new app! Wanna join? +
+ +
+ + + +
+
+ Sarah Bullock + + 23 Jan 6:10 pm + +
+ + message user image + +
I would love to.
+ +
+ +
+ + + +
+ + +
+ +
+ +
+
+
+ + + + +
+
+
+ +
+ +
+ + +
+ +
+
+

Latest Members

+ +
+ 8 New Members + + +
+
+ +
+
+
+ User Image + + Alexander Pierce + +
Today
+
+
+ User Image + + Norman + +
Yesterday
+
+
+ User Image + + Jane + +
12 Jan
+
+
+ User Image + + John + +
12 Jan
+
+
+ User Image + + Alexander + +
13 Jan
+
+
+ User Image + + Sarah + +
14 Jan
+
+
+ User Image + + Nora + +
15 Jan
+
+
+ User Image + + Nadia + +
15 Jan
+
+
+ +
+ +
+ View All Users +
+ +
+ +
+ +
+ + + +
+
+

Latest Orders

+ +
+ + +
+
+ +
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Order IDItemStatusPopularity
+ OR9842 + Call of Duty IV + Shipped + +
+
+ OR1848 + Samsung Smart TV + Pending + +
+
+ OR7429 + iPhone 6 Plus + Delivered + +
+
+ OR7429 + Samsung Smart TV + Processing + +
+
+ OR1848 + Samsung Smart TV + Pending + +
+
+ OR7429 + iPhone 6 Plus + Delivered + +
+
+ OR9842 + Call of Duty IV + Shipped + +
+
+
+ +
+ +
+ + Place New Order + + + View All Orders + +
+ +
+ +
+ + +
+ +
+ + + + +
+ Inventory + 5,200 +
+ +
+ +
+ + + + +
+ Mentions + 92,050 +
+ +
+ +
+ + + + +
+ Downloads + 114,381 +
+ +
+ +
+ + + + +
+ Direct Messages + 163,921 +
+ +
+ + +
+
+

Browser Usage

+ +
+ + +
+
+ +
+ +
+
+
+
+ +
+ +
+ +
+ +
+ +
+ + + +
+
+

Recently Added Products

+ +
+ + +
+
+ +
+
+
+
+ Product Image +
+
+ + Samsung TV + $1800 + +
Samsung 32" 1080p 60Hz LED Smart HDTV.
+
+
+ +
+
+ Product Image +
+
+ + Bicycle + $700 + +
+ 26" Mongoose Dolomite Men's 7-speed, Navy Blue. +
+
+
+ +
+
+ Product Image +
+
+ + Xbox One + $350 + +
+ Xbox One Console Bundle with Halo Master Chief Collection. +
+
+
+ +
+
+ Product Image +
+
+ + PlayStation 4 + $399 + +
PlayStation 4 500GB Console (PS4)
+
+
+ +
+
+ +
+ View All Products +
+ +
+ +
+ +
+ +
+ +
+ +
+ + +
+ +
Anything you want
+ + + + Copyright © 2014-2025  + AdminLTE.io. + + All rights reserved. + +
+ +
+ + + + + + + + + + + + + + + + + + + + + + + + diff --git a/dist/index3 2.html b/dist/index3 2.html new file mode 100644 index 000000000..58ba51ffd --- /dev/null +++ b/dist/index3 2.html @@ -0,0 +1,1289 @@ + + + + + + AdminLTE | Dashboard v3 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + + + + + + +
+ +
+ +
+ +
+
+

Dashboard v3

+
+
+
    +
  1. Home
    2. +
  2. Dashboard v3
    3. +
+
+
+ +
+ +
+
+ +
+ +
+
+
+
+
+

Online Store Visitors

+ View Report +
+
+
+
+

+ 820 + Visitors Over Time +

+

+ 12.5% + Since last week +

+
+ + +
+
+
+ +
+ + This Week + + + Last Week +
+
+
+ + +
+
+

Products

+
+ + + + + + +
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ProductPriceSalesMore
+ Product 1 + Some Product + $13 USD + + + 12% + + 12,000 Sold + + + + +
+ Product 1 + Another Product + $29 USD + + + 0.5% + + 123,234 Sold + + + + +
+ Product 1 + Amazing Product + $1,230 USD + + + 3% + + 198 Sold + + + + +
+ Product 1 + Perfect Item + NEW + $199 USD + + + 63% + + 87 Sold + + + + +
+
+
+ +
+ +
+
+
+
+

Sales

+ View Report +
+
+
+
+

+ $18,230.00 + Sales Over Time +

+

+ 33.1% + Since Past Year +

+
+ + +
+
+
+ +
+ + This year + + + Last year +
+
+
+ + +
+
+

Online Store Overview

+
+ + + + + + +
+
+
+
+

+ +

+

+ + 12% + + CONVERSION RATE +

+
+ +
+

+ +

+

+ + 0.8% + + SALES RATE +

+
+ +
+

+ +

+

+ + + 1% + + REGISTRATION RATE +

+
+ +
+
+
+ +
+ +
+ +
+ +
+ + +
+ +
Anything you want
+ + + + Copyright © 2014-2025  + AdminLTE.io. + + All rights reserved. + +
+ +
+ + + + + + + + + + + + + + + + + + + + + + + +