Plugins are separate processes. They read "Mattermost-User-Id" off the
request as a literal string, compiled against the published server/public
module -- not against this tree. Renaming it here did not rename it there.
It also produced a header name with a space in it, which is not a valid
header name, so what shipped was a request the plugin could not read and
would not have been able to read under any spelling. Every plugin HTTP
route answered 401: the Agents API, its admin config, the webapp's whole
agents surface.
The same rename hit "Mattermost-Plugin-ID", the push proxy's
"X-Mattermost-Auth" and "X-Mattermost-ServerID", and the session
attribute device header. These are wire protocol, and the wire is shared
with software that is not ours to rename.
Brand strings the product actually shows -- the site name, the MFA
issuer, email product names -- are untouched. The outbound user agent
stays ours but loses its space: HanzoTeam-Bot/1.1 is a product token,
"Hanzo Team-Bot/1.1" is two.
Co-authored-by: Hanzo Dev <[email protected]>
Renames the product across user-facing text -- 1475 lines, i18n and the
defaultMessage strings that must match it -- while leaving the names that
are code rather than prose: upstream copyright, Go import paths, the
@mattermost npm scope, i18n keys, Go template fields, and legacy theme
identifiers like AuthorType.Mattermost and the 'Mattermost' key that maps
an old theme to a new one. The rule is a word boundary on identifier
characters; MattermostEntry is a symbol, "Mattermost" in a sentence is
the product.
The theme goes monochrome. Hanzo and Hanzo Dark are the two built-ins and
Hanzo is the default, with the CSS custom properties that carry brand
colour outside the theme object -- sidebar, buttons, links, titles --
moved to black. Status colours stay: online, away, do-not-disturb and
error encode state, not brand, and flattening them to grey would cost
meaning to buy consistency.
The sign-in header drops the TEAM EDITION badge. It advertised which
licence tier you were on, and there are no tiers here. Booting without a
licence is now logged at debug rather than warned about, because it is
this server's normal condition rather than a fault.
Co-authored-by: Hanzo Dev <[email protected]>
Canonicalize IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) to
their native IPv4 form in IsReservedIP before checking against reserved
IP ranges. This prevents attackers from bypassing SSRF protections by
using IPv4-mapped IPv6 literals to access internal services.
zeekayandHanzo Dev