search

Flipez / hubot-rss-rolf

RSS Reader on Hubot
https://www.npmjs.org/package/hubot-rss-rolf
9 stars 4 forks source link

Security: abuse of "rss delete #room" #7

Closed localguru closed 7 years ago

localguru commented 7 years ago

Hi Robert,

at the moment it is possible for any user to delete any rss delete #room. We offer several public readonly channels with rss feeds in Rocket.Chat. Even though a user can't post messages to those readonly channels and and send bot commands, it's possible to remove the complete "rss room" from another channel or private room. Furthermore it is possible to delete rss rooms in other user's private rooms (assumed you know the room name). Therefore I posted a PR https://github.com/Flipez/hubot-rss-rolf/pull/6

Ciao Marcus

Flipez commented 7 years ago

Hi Marcus,

thank you for your contributions!

They all three seemed reasonable for me and I merged them into master and released them to npm.

Please let me know if something does not work as intended :)

Thanks for providing these cool things :+1:

localguru commented 7 years ago

Thanks Robert. Have a nice weekend, Marcus