From 69a08327d24d08ba7a4e879116eeff60ac2a3874 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 14:13:05 +0000 Subject: dashboard: hand over a token reading the member list only Review finding 8, second part: opening another member's dashboard handed it a token reading everything (READ_ALL). A member writes its own dashboard URL, so a malicious one received a read-everything token under the operator's identity: /admin/config, /admin/changes, /admin/log and the rest, on every node the user reaches. The token handed over now reads the member list only (READ_MEMBERS, as sent to subscribed nodes), which is enough to draw the map; the user logs in at the other dashboard to see more. With 1151 it lasts five minutes and isn't refreshed past them. --- docs/dashboard.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'docs/dashboard.md') diff --git a/docs/dashboard.md b/docs/dashboard.md index 2e482e8..01507df 100644 --- a/docs/dashboard.md +++ b/docs/dashboard.md @@ -204,10 +204,11 @@ measured. * **Right-click a node**: its menu: subscribing, and opening its dashboard. * **Open a node's dashboard** (its menu): in this page, where the node publishes one (`--dashboard-url`, in the member list; e.g. behind a reverse proxy, - [`operations.md`](operations.md)). A token from this node goes along, reading only, - for five minutes: where the browser has no session at the other dashboard, its login - page begins one with it (reading only; log in there to do more), unless its proxy asks - for credentials of its own. It opens as this one was left: the map's nodes where + [`operations.md`](operations.md)). A token from this node goes along, reading the + member list only, for five minutes, enough for the map: where the browser has no + session at the other dashboard, its login page begins one with it (log in there to + see more), unless its proxy asks for credentials of its own. Whoever publishes the + dashboard (a member writes its own URL) gets that token, no more. It opens as this one was left: the map's nodes where they were (on a dynamic map they then move to their places among the other node's links, smoothly; new ones are placed among them), the view, the pins, what is in focus, the legend shown or hidden, what is open in the figures and in the document, -- cgit v1.3.1