nik/FreedomBox
1
0
Fork 0
mirror of https://github.com/freedombox/FreedomBox.git synced 2026-07-29 12:09:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): unauthenticated api endpoint exposes domain inform

Browse Source 
The access_info API view in plinth/modules/api/views.py returns a list of all registered domains and their types without requiring authentication. This exposes sensitive network configuration information to unauthenticated users.

Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com>
This commit is contained in:
tomaioo 2026-05-05 11:06:39 -07:00
parent bacaa59725
commit 49ab335e1b
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
plinth/modules/api/views.py
View File

@ -16,6 +16,8 @@ from plinth.modules import names
def access_info(request: HttpRequest, **kwargs) -> HttpResponse:
"""API view to return a list of domains and types."""
if not request.user.is_authenticated:
return HttpResponse(status=401)
domains = [{
'domain': domain.name,
'type': domain.domain_type.component_id