Skip to content

v0.1.10

Choose a tag to compare

View all tags
@engels74 engels74 released this 24 Feb 18:51
· 163 commits to main since this release
0.1.10
06a407d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Bug Fixes

  • Prevent PRIVATE_LINK token leak in landing page lookup (#44)
    • The lookupUser action previously retrieved or generated the secret share token and redirected unauthenticated visitors directly to the token URL, defeating PRIVATE_LINK mode by exposing the token to anyone who knew a username
    • Access control is now fully delegated to the wrapped page's checkWrappedAccess, which correctly denies access when no token is present in the URL

Full Changelog: 0.1.9...0.1.10

Assets 2
Loading