From 69a08327d24d08ba7a4e879116eeff60ac2a3874 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 14:13:05 +0000 Subject: dashboard: hand over a token reading the member list only Review finding 8, second part: opening another member's dashboard handed it a token reading everything (READ_ALL). A member writes its own dashboard URL, so a malicious one received a read-everything token under the operator's identity: /admin/config, /admin/changes, /admin/log and the rest, on every node the user reaches. The token handed over now reads the member list only (READ_MEMBERS, as sent to subscribed nodes), which is enough to draw the map; the user logs in at the other dashboard to see more. With 1151 it lasts five minutes and isn't refreshed past them. --- src/api/dashboard/login.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/api/dashboard/login.html') diff --git a/src/api/dashboard/login.html b/src/api/dashboard/login.html index e09d31c..74c9fd1 100644 --- a/src/api/dashboard/login.html +++ b/src/api/dashboard/login.html @@ -74,7 +74,7 @@ document.getElementById("token").addEventListener("submit", async event => { try { await begin(event.target.token.value.trim()); } catch (error) { failed(error); } }); // Opened from another member's dashboard (`handOff`), sent here for want of a session: -// its token, reading only, begins one; the rest goes on to the dashboard. +// its token, reading the member list only, begins one; the rest goes on to the dashboard. (async () => { const HAND_OFF = "#continuum="; if (!location.hash.startsWith(HAND_OFF)) return; -- cgit v1.3.1