35 lines
1.0 KiB
Diff
35 lines
1.0 KiB
Diff
--- CHANGELOG.md
|
|
@@ -2,6 +2,11 @@
|
|
|
|
All notable changes to this project will be documented in this file. For commit guidelines, please refer to [Standard Version](https://github.com/conventional-changelog/standard-version).
|
|
|
|
+## v1.4.1
|
|
+
|
|
+ **Security**:
|
|
+ - Fix critical: unauthenticated user can view source info
|
|
+
|
|
## v1.4.0
|
|
|
|
**New Features**:
|
|
|
|
--- backend/common/settings/settings.go
|
|
@@ -133,6 +133,10 @@ func ApplyUserDefaults(u *users.User) {
|
|
// FileLoading settings
|
|
u.FileLoading = d.FileLoading
|
|
|
|
+ if u.Username == "anonymous" {
|
|
+ return
|
|
+ }
|
|
+
|
|
// Permissions
|
|
u.Permissions.Api = d.Account.Permissions.Api
|
|
u.Permissions.Admin = d.Account.Permissions.Admin
|
|
@@ -147,7 +151,7 @@ func ApplyUserDefaults(u *users.User) {
|
|
u.LoginMethod = users.LoginMethod(d.Account.LoginMethod)
|
|
}
|
|
|
|
- if len(u.Scopes) == 0 && u.Username != "anonymous" {
|
|
+ if len(u.Scopes) == 0 {
|
|
for _, source := range Config.Server.Sources {
|
|
if source.Config.DefaultEnabled {
|
|
u.Scopes = append(u.Scopes, users.SourceScope{
|