medlogic
/
olivetin
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security: IDOR on ExecutionStatus API

This commit is contained in:
jamesread 2026-02-26 20:23:48 +00:00
parent 5cbcf29704
commit 24cced0c8c
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
service/internal/api/api.go
View File

@ -384,10 +384,11 @@ func (api *oliveTinAPI) ExecutionStatus(ctx ctx.Context, req *connect.Request[ap
if ile == nil { if ile == nil {
return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("execution not found for tracking ID %s or action ID %s", req.Msg.ExecutionTrackingId, req.Msg.ActionId)) return nil, connect.NewError(connect.CodeNotFound, fmt.Errorf("execution not found for tracking ID %s or action ID %s", req.Msg.ExecutionTrackingId, req.Msg.ActionId))
} else {
res.LogEntry = api.internalLogEntryToPb(ile, user)
} }
if !isValidLogEntry(ile) || !api.isLogEntryAllowed(ile, user) {
return nil, connect.NewError(connect.CodePermissionDenied, fmt.Errorf("permission denied to view this execution"))
}
res.LogEntry = api.internalLogEntryToPb(ile, user)
return connect.NewResponse(res), nil return connect.NewResponse(res), nil
} }