medlogic
/
olivetin
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security: Possible to kill actions without authentication & credential leak in logs

This commit is contained in:
jamesread 2025-11-26 23:07:25 +00:00
parent be7c754043
commit 853972384c
2 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
service/internal/api/api.go
View File

@ -90,6 +90,7 @@ func (api *oliveTinAPI) killActionByTrackingId(user *authpublic.AuthenticatedUse
if !acl.IsAllowedKill(api.cfg, user, action) { if !acl.IsAllowedKill(api.cfg, user, action) {
log.Warnf("Killing execution request not possible - user not allowed to kill this action: %v", execReqLogEntry.ExecutionTrackingID) log.Warnf("Killing execution request not possible - user not allowed to kill this action: %v", execReqLogEntry.ExecutionTrackingID)
ret.Killed = false ret.Killed = false
return
} }
err := api.executor.Kill(execReqLogEntry) err := api.executor.Kill(execReqLogEntry)

2
service/internal/auth/authcheck.go
View File

@ -45,7 +45,7 @@ func runAuthChain[T any](req *connect.Request[T], cfg *config.Config) *types.Aut
func UserFromApiCall[T any](ctx context.Context, req *connect.Request[T], cfg *config.Config) *types.AuthenticatedUser { func UserFromApiCall[T any](ctx context.Context, req *connect.Request[T], cfg *config.Config) *types.AuthenticatedUser {
user := runAuthChain(req, cfg) user := runAuthChain(req, cfg)
log.Infof("Context: %+v", ctx) log.Tracef("UserFromApiCall Context: %+v", ctx)
if user == nil || user.Username == "" { if user == nil || user.Username == "" {
user = UserGuest(cfg) user = UserGuest(cfg)