mirror of
https://github.com/wallabag/wallabag.git
synced 2024-09-24 12:29:59 +00:00
0fdd9aa991
We fix the improper authorization by duplicating the check done by the private method EntryController::checkUserAction(). We also replace the ParamConverter used to get the requested Entry with an explicit call to EntryRepository in order to prevent a resource enumeration through response discrepancy. Thus, we get the same exception whether the requested resource does not exist or is not owned by the requester. Fixes GHSA-qwx8-mxxx-mg96 Signed-off-by: Kevin Decherf <kevin@kdecherf.com> |
||
|---|---|---|
| .. | ||
| AnnotationBundle | ||
| ApiBundle | ||
| CoreBundle | ||
| ImportBundle | ||
| UserBundle | ||