Mailu 2024.06's token endpoint models AuthorizedIP as a list of CIDRs and declares its expect without validate=True; the POST handler assigns token_new.ip from data['AuthorizedIP'] and never from data['ip']. The 'ip' key this role sent was therefore discarded, and every token it created has always been unrestricted.
The value behind it was a forbidden substantive default on networks.internet.ip4, introduced as drive-by collateral in 087175a3c, a commit about the token comment. Removing both is behaviour-preserving and restores the original intent.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Add tests/lint/repository/test_task_file_numbering.py: numbered task
files use exactly two leading digits, a numbered *_core.yml must be
00_core.yml, per directory the numbers are unique/consecutive and start
at 01 (00 with a core file), numbered includes appear in ascending
order, and shared helpers live in tasks/utils/ instead of the numbered
chain.
Apply it across every role: rename NN_core.yml to 00_core.yml with a
consecutive down-shift of the siblings, move letter-suffix children into
a subdirectory named after their parent task, relocate helpers included
from more than one place into tasks/utils/, and update every reference
(include_tasks, path_absolute, .ansible-lint-ignore, requirement docs).
Legacy narration comments in the touched files are deleted; the upstream
xwiki.properties reference block opts out via nocheck. The unused
MAILU_IP6_PUBLIC var (only ever named in now-removed comments) is dropped.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5