diff options
| author | tv <tv@krebsco.de> | 2026-11-08 14:13:05 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-08 15:26:03 +0100 |
| commit | 69a08327d24d08ba7a4e879116eeff60ac2a3874 (patch) | |
| tree | ca822e7efe7123c290fd7923034cd5123fe5584a /docs/dashboard.md | |
| parent | 5de2994c6d8f5f266d60b4febdf9252a035488ad (diff) | |
dashboard: hand over a token reading the member list only
Review finding 8, second part: opening another member's dashboard
handed it a token reading everything (READ_ALL). A member writes its
own dashboard URL, so a malicious one received a read-everything token
under the operator's identity: /admin/config, /admin/changes,
/admin/log and the rest, on every node the user reaches.
The token handed over now reads the member list only (READ_MEMBERS, as
sent to subscribed nodes), which is enough to draw the map; the user
logs in at the other dashboard to see more. With 1151 it lasts five
minutes and isn't refreshed past them.
Diffstat (limited to 'docs/dashboard.md')
| -rw-r--r-- | docs/dashboard.md | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/docs/dashboard.md b/docs/dashboard.md index 2e482e8..01507df 100644 --- a/docs/dashboard.md +++ b/docs/dashboard.md @@ -204,10 +204,11 @@ measured. * **Right-click a node**: its menu: subscribing, and opening its dashboard. * **Open a node's dashboard** (its menu): in this page, where the node publishes one (`--dashboard-url`, in the member list; e.g. behind a reverse proxy, - [`operations.md`](operations.md)). A token from this node goes along, reading only, - for five minutes: where the browser has no session at the other dashboard, its login - page begins one with it (reading only; log in there to do more), unless its proxy asks - for credentials of its own. It opens as this one was left: the map's nodes where + [`operations.md`](operations.md)). A token from this node goes along, reading the + member list only, for five minutes, enough for the map: where the browser has no + session at the other dashboard, its login page begins one with it (log in there to + see more), unless its proxy asks for credentials of its own. Whoever publishes the + dashboard (a member writes its own URL) gets that token, no more. It opens as this one was left: the map's nodes where they were (on a dynamic map they then move to their places among the other node's links, smoothly; new ones are placed among them), the view, the pins, what is in focus, the legend shown or hidden, what is open in the figures and in the document, |