From ccb5636bed43d2150d332eb4a1cb85bea4fb2a28 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matej=20Ba=C4=8Do?= Date: Mon, 4 Mar 2024 07:27:26 +0000 Subject: [PATCH] fix session security --- app/controllers/api/account.php | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php index 3a0f7354f..cb8cba30e 100644 --- a/app/controllers/api/account.php +++ b/app/controllers/api/account.php @@ -2154,6 +2154,10 @@ App::get('/v1/account/sessions') ->inject('project') ->action(function (Response $response, Document $user, Locale $locale, Document $project) { + $roles = Authorization::getRoles(); + $isPrivilegedUser = Auth::isPrivilegedUser($roles); + $isAppUser = Auth::isAppUser($roles); + $sessions = $user->getAttribute('sessions', []); $current = Auth::sessionVerify($sessions, Auth::$secret); @@ -2162,6 +2166,8 @@ App::get('/v1/account/sessions') $session->setAttribute('countryName', $countryName); $session->setAttribute('current', ($current == $session->getId()) ? true : false); + $session->setAttribute('secret', ($isPrivilegedUser || $isAppUser) ? $session->getAttribute('secret', '') : ''); + $sessions[$key] = $session; } @@ -2256,6 +2262,10 @@ App::get('/v1/account/sessions/:sessionId') ->inject('project') ->action(function (?string $sessionId, Response $response, Document $user, Locale $locale, Document $project) { + $roles = Authorization::getRoles(); + $isPrivilegedUser = Auth::isPrivilegedUser($roles); + $isAppUser = Auth::isAppUser($roles); + $sessions = $user->getAttribute('sessions', []); $sessionId = ($sessionId === 'current') ? Auth::sessionVerify($user->getAttribute('sessions'), Auth::$secret) @@ -2268,6 +2278,7 @@ App::get('/v1/account/sessions/:sessionId') $session ->setAttribute('current', ($session->getAttribute('secret') == Auth::hash(Auth::$secret))) ->setAttribute('countryName', $countryName) + ->setAttribute('secret', ($isPrivilegedUser || $isAppUser) ? $session->getAttribute('secret', '') : '') ; return $response->dynamic($session, Response::MODEL_SESSION);