public/once-campfire
1
0
Fork 0
mirror of https://github.com/basecamp/once-campfire.git synced 2026-09-20 07:17:09 +09:00
Code Issues Packages Projects Releases Wiki Activity

Security: Fix user impersonation via custom bot token

Browse Source 
If bot_key has no right-hand side (ex: 1-), bot_token will be nil, and the query will match a User record if bot_id matches a valid ID.
Fix it relying on `active_bots` instead.
This commit is contained in:
Jacopo
2025-09-11 12:24:39 +02:00
committed by Jacopo Beschi
parent ddbf1460db
commit 3d0a10dbdd
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/models/user/bot.rb
+1 -1
View File
@@ -19,7 +19,7 @@ module User::Bot
def authenticate_bot(bot_key)
bot_id, bot_token = bot_key.split("-")
active.find_by(id: bot_id, bot_token: bot_token)
active_bots.find_by(id: bot_id, bot_token: bot_token)
end
def generate_bot_token