From 853972384cce7f3db982e32cfe993f4c8a3b22ed Mon Sep 17 00:00:00 2001 From: jamesread Date: Wed, 26 Nov 2025 23:07:25 +0000 Subject: [PATCH] security: Possible to kill actions without authentication & credential leak in logs --- service/internal/api/api.go | 1 + service/internal/auth/authcheck.go | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/service/internal/api/api.go b/service/internal/api/api.go index d7c3693..d35227c 100644 --- a/service/internal/api/api.go +++ b/service/internal/api/api.go @@ -90,6 +90,7 @@ func (api *oliveTinAPI) killActionByTrackingId(user *authpublic.AuthenticatedUse if !acl.IsAllowedKill(api.cfg, user, action) { log.Warnf("Killing execution request not possible - user not allowed to kill this action: %v", execReqLogEntry.ExecutionTrackingID) ret.Killed = false + return } err := api.executor.Kill(execReqLogEntry) diff --git a/service/internal/auth/authcheck.go b/service/internal/auth/authcheck.go index 331767b..3b612b9 100644 --- a/service/internal/auth/authcheck.go +++ b/service/internal/auth/authcheck.go @@ -45,7 +45,7 @@ func runAuthChain[T any](req *connect.Request[T], cfg *config.Config) *types.Aut func UserFromApiCall[T any](ctx context.Context, req *connect.Request[T], cfg *config.Config) *types.AuthenticatedUser { user := runAuthChain(req, cfg) - log.Infof("Context: %+v", ctx) + log.Tracef("UserFromApiCall Context: %+v", ctx) if user == nil || user.Username == "" { user = UserGuest(cfg)