From 49ab335e1b28adca7e5189b853b7b144f9ffdcc1 Mon Sep 17 00:00:00 2001 From: tomaioo Date: Tue, 5 May 2026 11:06:39 -0700 Subject: [PATCH] fix(security): unauthenticated api endpoint exposes domain inform The access_info API view in plinth/modules/api/views.py returns a list of all registered domains and their types without requiring authentication. This exposes sensitive network configuration information to unauthenticated users. Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- plinth/modules/api/views.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/plinth/modules/api/views.py b/plinth/modules/api/views.py index ac3aff0fd..6e6f2b865 100644 --- a/plinth/modules/api/views.py +++ b/plinth/modules/api/views.py @@ -16,6 +16,8 @@ from plinth.modules import names def access_info(request: HttpRequest, **kwargs) -> HttpResponse: """API view to return a list of domains and types.""" + if not request.user.is_authenticated: + return HttpResponse(status=401) domains = [{ 'domain': domain.name, 'type': domain.domain_type.component_id