Richard Hansen b80a37173e security: Fix authorization bypass vulnerability ... Before, a malicious user could bypass authorization restrictions imposed by the authorize hook: * Step 1: Fetch any resource that the malicious user is authorized to access (e.g., static content). * Step 2: Use the signed express_sid cookie generated in step 1 to create a socket.io connection. * Step 3: Perform the CLIENT_READY handshake for the desired pad. * Step 4: Profit! Now the authorization decision made by the authorize hook is propagated to SecurityManager so that it can approve or reject socket.io messages as appropriate. This also sets up future support for per-user read-only and modify-only (no create) authorization levels.		2020-09-15 21:40:25 +01:00
..
API.js	api: in getStats(), directly rewrote activePads as an expression	2020-04-04 22:03:46 +02:00
AuthorManager.js	import: Use the correct author ID when using sessions	2020-09-08 15:04:17 +01:00
DB.js	DB.js: remove else clause, since we are already exiting early	2020-03-24 23:26:19 +01:00
GroupManager.js	GroupManager: typo during session deletion	2020-09-08 00:45:39 +01:00
Pad.js	backups: include the pool every 100 revs stored (#3991)	2020-06-05 22:46:12 +01:00
PadManager.js	PadManager: use a set instead of an array in padlist	2020-04-09 03:39:32 +02:00
ReadOnlyManager.js	db/ReadOnlyManager.js: completed conversion	2019-01-30 16:19:51 +00:00
SecurityManager.js	security: Fix authorization bypass vulnerability	2020-09-15 21:40:25 +01:00
SessionManager.js	SecurityManager: Refactor checkAccess for readability, correctness	2020-09-12 09:42:47 +01:00
SessionStore.js	Revert "SessionStore: replace password with PASSWORD_HIDDEN when storing in db"	2020-05-17 13:00:17 +02:00