Please sign in to comment.
Make sure that clients can't access buffers belonging to other users
A manipulated, but properly authenticated client was able to retrieve the backlog of other users on the same core in some cases by providing an appropriate BufferID to the storage engine. Note that proper authentication was still required, so exploiting this requires malicious users on your core. This commit fixes this issue by ensuring that foreign BufferIDs are off-limits.
- Loading branch information...
Showing with 4 additions and 3 deletions.
|@@ -1,3 +1,3 @@|
|SELECT bufferid, networkid, buffertype, groupid, buffername|
|-WHERE bufferid = :bufferid|
|+WHERE userid = :userid AND bufferid = :bufferid|