Mirrors/etherpad-lite
1
0
Fork 0
mirror of https://github.com/ether/etherpad-lite.git synced 2026-07-25 02:57:09 +00:00
Code Issues Projects Releases Wiki Activity
etherpad-lite/src
History
Richard Hansen b80a37173e security: Fix authorization bypass vulnerability 
Before, a malicious user could bypass authorization restrictions
imposed by the authorize hook:

 * Step 1: Fetch any resource that the malicious user is authorized to
   access (e.g., static content).
 * Step 2: Use the signed express_sid cookie generated in step 1 to
   create a socket.io connection.
 * Step 3: Perform the CLIENT_READY handshake for the desired pad.
 * Step 4: Profit!

Now the authorization decision made by the authorize hook is
propagated to SecurityManager so that it can approve or reject
socket.io messages as appropriate.

This also sets up future support for per-user read-only and
modify-only (no create) authorization levels.
2020-09-15 21:40:25 +01:00
..
locales Localisation updates from https://translatewiki.net. 2020-09-10 18:36:59 +02:00
node security: Fix authorization bypass vulnerability 2020-09-15 21:40:25 +01:00
static Pad: Disable toolbar and import/export when reconnecting 2020-09-15 20:04:17 +01:00
templates plugins: Move plugin definitions to avoid monkey patching 2020-09-08 00:50:24 +01:00
ep.json openapi: implement API handler with openapi-backend 2020-04-03 01:03:11 +02:00
etherpad_icon.svg Change favicon to be closer to new style 2020-04-19 18:20:21 +02:00
package-lock.json tests: Use wtfnode to determine why mocha isn't exiting 2020-09-15 21:22:52 +01:00
package.json tests: Use wtfnode to determine why mocha isn't exiting 2020-09-15 21:22:52 +01:00
README.md remove one less warning during install by having a readme placeholder 2013-02-10 03:04:08 +00:00
web.config Add IIS config file 2012-10-25 10:22:28 -07:00

README.md

Ignore this file and see the file in the base installation folder