Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] User Can look at Google ID, Github Client ID and Client Secret #213

Open
SnowyYT07 opened this issue Oct 9, 2024 · 2 comments
Open
Assignees
Labels
bug Something isn't working unconfirmed not confirmed by developer

Comments

@SnowyYT07
Copy link

Describe the bug
The bug is achieved via changing the cookie info giving the user permission to see Admin settings. Making possible user exfil Google ID, Github Client ID, Client Secret and even create links for register

To Reproduce
Steps to reproduce the behavior:

  1. Go to the 'Application' tab in chrome dev tools or similar in your browser choice
  2. Click on 'local storage'
  3. Edit the cookie 'VOCECHAT_LOGIN_USER'
  4. Set the "is_admin" to true

Expected behavior
Well, in a perfect and secure condition, nothing should appear, but on this case, the admin configuration settings was visible to me.

Screenshots
image
image
image

Desktop (please complete the following information):

  • OS: [Windows 11]
  • Browser [Chrome]
  • Server Version [v0.3.8]
  • Client Version [v0.7.42]
  • Server running on: [Mint 21]

Misc..

User can also check License, as I reported minutes ago. Issue #212

@SnowyYT07 SnowyYT07 added bug Something isn't working unconfirmed not confirmed by developer labels Oct 9, 2024
@RoeWade
Copy link

RoeWade commented Oct 11, 2024

Already following

@zsr-lukezhang
Copy link

zsr-lukezhang commented Nov 5, 2024

Pls show me how to do it via Cookie-Editor.
(I'm not a developer, but I'm curios about this bug)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working unconfirmed not confirmed by developer
Projects
None yet
Development

No branches or pull requests

4 participants