dashboard: hand over a token reading the member list only

Review finding 8, second part: opening another member's dashboard
handed it a token reading everything (READ_ALL). A member writes its
own dashboard URL, so a malicious one received a read-everything token
under the operator's identity: /admin/config, /admin/changes,
/admin/log and the rest, on every node the user reaches.

The token handed over now reads the member list only (READ_MEMBERS, as
sent to subscribed nodes), which is enough to draw the map; the user
logs in at the other dashboard to see more. With 1151 it lasts five
minutes and isn't refreshed past them.

1 files changed, 1 insertions, 1 deletions

diff --git a/src/api/dashboard/login.html b/src/api/dashboard/login.html
index e09d31c..74c9fd1 100644
--- a/src/api/dashboard/login.html
+++ b/src/api/dashboard/login.html
@@ -74,7 +74,7 @@ document.getElementById("token").addEventListener("submit", async event => {
   try { await begin(event.target.token.value.trim()); } catch (error) { failed(error); }
 });
 // Opened from another member's dashboard (`handOff`), sent here for want of a session:
-// its token, reading only, begins one; the rest goes on to the dashboard.
+// its token, reading the member list only, begins one; the rest goes on to the dashboard.
 (async () => {
   const HAND_OFF = "#continuum=";
   if (!location.hash.startsWith(HAND_OFF)) return;