New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Rooms API open to everyone #245

Open

ncasnap opened this issue Sep 10, 2024 · 0 comments

ncasnap commented Sep 10, 2024

Bug Report

Problematic behavior
The django API is too open. If we just make a GET Request to https://domain/api/rooms/name_of_room

We can retrieve all the information including the token. This is problematic as with the token we can bypass the restriction of a room.

Expected behavior/code
The GET requests of specific room should work only for an authenticated user owning the room.

Steps to Reproduce

Make a GET Request to https://domain/api/rooms/name_of_room

Environment

Jitsi magnify version: last version available

@jbpenrath, can you help us on this issue ?

Thanks in advance,
Regards,
Nathan

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment