mirror of
https://github.com/wallabag/wallabag.git
synced 2025-01-26 08:38:09 +00:00
0fdd9aa991
We fix the improper authorization by duplicating the check done by the private method EntryController::checkUserAction(). We also replace the ParamConverter used to get the requested Entry with an explicit call to EntryRepository in order to prevent a resource enumeration through response discrepancy. Thus, we get the same exception whether the requested resource does not exist or is not owned by the requester. Fixes GHSA-qwx8-mxxx-mg96 Signed-off-by: Kevin Decherf <kevin@kdecherf.com> |
||
|---|---|---|
| .. | ||
| ConfigControllerTest.php | ||
| EntryControllerTest.php | ||
| ExportControllerTest.php | ||
| FeedControllerTest.php | ||
| IgnoreOriginInstanceRuleControllerTest.php | ||
| SecurityControllerTest.php | ||
| SettingsControllerTest.php | ||
| SiteCredentialControllerTest.php | ||
| StaticControllerTest.php | ||
| TagControllerTest.php | ||