0fdd9aa991
We fix the improper authorization by duplicating the check done by the private method EntryController::checkUserAction(). We also replace the ParamConverter used to get the requested Entry with an explicit call to EntryRepository in order to prevent a resource enumeration through response discrepancy. Thus, we get the same exception whether the requested resource does not exist or is not owned by the requester. Fixes GHSA-qwx8-mxxx-mg96 Signed-off-by: Kevin Decherf <kevin@kdecherf.com> |
||
|---|---|---|
| .github | ||
| app | ||
| bin | ||
| data/db | ||
| docker | ||
| scripts | ||
| src | ||
| tests/Wallabag | ||
| var | ||
| web | ||
| .babelrc | ||
| .composer-auth.json | ||
| .editorconfig | ||
| .eslintrc.json | ||
| .gitattributes | ||
| .gitignore | ||
| .nvmrc | ||
| .php_cs | ||
| CHANGELOG.md | ||
| CODE_OF_CONDUCT.md | ||
| composer.json | ||
| composer.lock | ||
| COPYING.md | ||
| CREDITS.md | ||
| docker-compose.yml | ||
| GNUmakefile | ||
| Makefile | ||
| package.json | ||
| phpstan.neon | ||
| phpunit.xml.dist | ||
| README.md | ||
| RELEASE_PROCESS.md | ||
| SECURITY.md | ||
| stylelint.config.js | ||
| webpack.config.js | ||
| yarn.lock | ||
wallabag
wallabag is a web application allowing you to save web pages for later reading. Click, save and read it when you want. It extracts content so that you won't be distracted by pop-ups and cie.
You can install it on your own server, or you can create an account on wallabag.it.
- Website: wallabag.org
- Android app: wallabag/android-app
- iOS app: wallabag/ios-app
- Browser extension: wallabag/wallabagger
Documentation
The documentation is available at https://doc.wallabag.org.
You can contribute to it through its dedicated repository, available here: https://github.com/wallabag/doc.
Installation
Please read the documentation to see the wallabag requirements.
Then you can install wallabag by executing the following commands:
git clone https://github.com/wallabag/wallabag.git
cd wallabag && make install
Now, configure a virtual host to use your wallabag.
Other methods
Refer to the installation documentation for other installation methods.
Translation
This project uses Weblate for translation.
Feel free to help us translating wallabag.
Contributing
To learn more about developing wallabag, please refer to the contribution guide.
Content extraction relies on Graby, php-readability and ftr-site-config.
License
Copyright © 2013-current Nicolas Lœuillet nicolas@loeuillet.org
This work is free. You can redistribute it and/or modify it under the terms of the MIT License. See the COPYING.md file for more details.