Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

admins cannot revoke sessions owned by other users #4856

Closed
BenLubar opened this issue Jul 15, 2016 · 3 comments
Closed

admins cannot revoke sessions owned by other users #4856

BenLubar opened this issue Jul 15, 2016 · 3 comments
Assignees
@julianlam
Labels
bug
Milestone
1.1.1

Comments

@BenLubar
Copy link
Contributor

https://github.com/boomzillawtf/tdwtf/tree/4866fca68b869575725e29627b5768ea868aa7fc
3df7bae

Sessions cannot be revoked for other users because this line retrieves the current user's sessions:

NodeBB/src/controllers/accounts/session.js

Line 19 in 3df7bae

db.getSortedSetRange('uid:' + req.uid + ':sessions', 0, -1, next);

Instead of req.uid, it should use req.locals.uid, which is set by middleware.exposeUid
@BenLubar
Copy link
Contributor Author

/cc @pauljherring @boomzillawtf

@pauljherring
Copy link

Ouch. So you couldn't have done it when I asked anyway?

@julianlam
Copy link
Member

Thanks for triaging this but 😄

@julianlam julianlam added the bug label Jul 15, 2016
@julianlam julianlam added this to the 1.1.1 milestone Jul 15, 2016
@julianlam julianlam self-assigned this Jul 15, 2016
BenLubar added a commit to boomzillawtf/tdwtf that referenced this issue Jul 15, 2016
@BenLubar
- Fixed: admins cannot revoke sessions owned by other users <NodeBB/N…
b189406 
…odeBB#4856>

- Fixed: permanent bans from the user's profile <NodeBB/NodeBB#4855>
- Fixed: "opening a topic page in background tab in Firefox 46.0.1 makes the page bugged" <NodeBB-Community/nodebb-plugin-emoji-extended@668d4ca>
This was referenced Oct 17, 2022
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@julianlam julianlam

Labels
bug
Projects
None yet
Milestone
1.1.1
Development

No branches or pull requests
3 participants
@julianlam @pauljherring @BenLubar