mirrors/etherpad-lite
1
0
Fork 0
mirror of https://github.com/ether/etherpad-lite.git synced 2025-05-02 13:19:14 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

PadMessageHandler: Don't trust user-provided padId

Browse source
This commit is contained in:
Richard Hansen 2022-02-23 01:03:46 -05:00
parent bdbde88fed
commit ba370b0e05
4 changed files with 115 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

5
CHANGELOG.md
View file

@ -2,6 +2,11 @@
(not yet released)
### Security fixes
* Fixed a vunlerability in the `CHANGESET_REQ` message handler that allowed a
user with any access to read any pad if the pad ID is known.
### Notable enhancements and fixes
* Fixed a bug that caused all pad edit messages received at the server to go