diff options
| author | Xavier Del Campo Romero <xavi92@disroot.org> | 2025-10-02 11:32:02 +0200 |
|---|---|---|
| committer | Xavier Del Campo Romero <xavi92@disroot.org> | 2025-10-02 11:32:02 +0200 |
| commit | 4dcd4d47cc717b37844dbe7f01485f9a0662a964 (patch) | |
| tree | 14d29627ce3a6ba70a67cd2b5dd2bebe9341e5aa /libweb | |
| parent | eeca79b7678176a6f8915da29d35f685f365e6da (diff) | |
| download | slcl-4dcd4d47cc717b37844dbe7f01485f9a0662a964.tar.gz | |
auth.c: Fix missing username check
So far, auth_login was looking for a key that matched the expected HMAC,
among all registered users, and therefore without looking up the
username from the cookie key.
This allowed attackers to forge a cookie with a valid key but another
username, and therefore see the contents from other users.
Diffstat (limited to 'libweb')
0 files changed, 0 insertions, 0 deletions