Skip to content

v3.0.4

Choose a tag to compare

View all tags
@ptheofan ptheofan released this 27 Jul 07:25
v3.0.4
b516450
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security

  • Cross-site requests can no longer change putiorr's state. Only
    POST /api/grab was protected; every other state-changing /api endpoint —
    settings, profiles, download profiles, starting and deleting downloads, the
    orphan routes, the OAuth routes and POST /api/poll — could be driven by any
    page the user happened to visit. No credentials were needed, because putiorr
    has none to steal: the attacker only needed the victim's browser to reach a
    putiorr on their network.

    A request is now refused when the browser reports it was started by another
    site. Nothing else changes: the dashboard, curl and scripts, the browser
    extension, and the *arr apps on the Transmission RPC endpoints are all
    unaffected, and reads are untouched. Refusals are logged with the path and
    method behind them.

    This is a mitigation, not a boundary. A caller that is not a browser is
    deliberately still allowed through — refusing those would break every
    scripted setup and would not stop the attack it is aimed at.

Assets 2
Loading