Skip to content

Security concerns #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
maximeg opened this issue Nov 14, 2012 · 3 comments
Closed

Security concerns #2

maximeg opened this issue Nov 14, 2012 · 3 comments
Assignees

Comments

@maximeg
Copy link

maximeg commented Nov 14, 2012

I'm not mélanchonien but this initiative is quite laudable.
I saw you took some precautions while disclosing the source code, but you missed some points.

In config/initializers/secret_token.rb :

PartiDeGauche::Application.config.secret_token = 'c38ac477282636ad9940105aa8445d626f281ea543def898337c77bbcb2979ffdd62085ad456dd5cf36c35c37ce02ffa21cfdf5bb6f444db86bb43090fe0aa31'

This is called secret for a reason. It is used to sign your cookies. You let your users vulnerable to a session hijacking.

In config/environment.rb :

PBX_SITE = "5133308"
PBX_SITE_TEST = "1999888"

These are part of a payment gateway credentials. For these ones, you're stuck with them being public, you can't regenerate them. Try calling Paybox.

In config/initializers/devise.rb :

require "omniauth-facebook"
config.omniauth :facebook, "293257790720210", "47c73941bce3de72e4dae13d0dd0b8b0", :strategy_class => OmniAuth::Strategies::Facebook

Here are the APP_ID and APP_SECRET for your facebook app.

Here is a little help. I wanted to talk about SettingsLogic, addressing such issues, so I jumped on the occasion :
http://emaxime.com/2012/managing-private-settings-with-settingslogic/

@maximeg
Copy link
Author

maximeg commented Nov 14, 2012

Diaspora use quite the same way through diaspora.yml (https://github.com/diaspora/diaspora/blob/develop/config/load_config.rb) that populates AppConfig. They added a fallback for avoiding developers to fill this entry in diaspora.yml in dev.

@ghost ghost assigned ddlamb2000 Nov 15, 2012
@ddlamb2000
Copy link
Contributor

The secret token key published here is the original key generated by Rails, but it's not used by production environments. The system uses a method similar to what's proposed here (diaspora) based on Capistrano.

The facebook Id and keycode isn't used by the application and refers to a kind of 'dummy' account that is never used, so those Ids will be cleaned-up. In any case the keys will be managed using Capistrano scripts.

For payment credentials, this refers to a test site in a test mode.

Thank you very much guys for your input here.

@ddlamb2000
Copy link
Contributor

Toutes les remarques ont été prises en compte:

  • suppression de la clé "secret_token"
  • suppression des informations paybox
  • suppression des informations application facebook.

@ghost ghost deleted a comment Jul 16, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants