Protect anonymous comments from being changed by other users #1235
Conversation
There was a problem hiding this comment.
Thx for the pr!
I think it makes sense to extend user id returned by AddDirectProviderWithUserIDFunc with X-Forwarded-For and X-Real-IP. Pls note - we likely should also handle chains of reported ips from those headers as each proxy level may append its ip.
Probably smth similar to this
paskal
changed the title
paskal
changed the title
|
@paleale pls let me know if you are planning to make the proposed change |
|
@umputun I am, back again, still uncertain about all the possible force majors, but I'd like to finish that at nearest holidays. |
|
My comment was probably inaccurate, or i have added it before we had |
Codecov Report
@@ Coverage Diff @@
## master #1235 +/- ##
=======================================
Coverage 50.19% 50.19%
=======================================
Files 139 139
Lines 3008 3008
Branches 642 642
=======================================
Hits 1510 1510
Misses 1490 1490
Partials 8 8 Continue to review full report at Codecov.
|
Direct auth from go-pkgz/auth used in Remark42 for anonymous authentication. The problem is that as soon as a user logs in with the same name as another anonymous user, they get precisely the same user ID and can delete or alter messages by that other user.
To prevent that, we need to provide custom UserIDFunc, which I propose should return hashed IP of the user so that there will be no way another anonymous user and I get the same ID at the same time, but it would be possible to re-login right away with the same ID if I want to adjust my anonymous comment.
Issue description has been originally provided by @paskal