search

LaWebcapsule / directus9

directus9 - openSource maintenance of directus
GNU General Public License v3.0
71 stars 9 forks source link

fix alias security vulnerability CVE-2024-34708 #66

Closed sofiachakir closed 4 months ago

sofiachakir commented 4 months ago

Directus9 allow redacted data extraction on the API through "alias".

This security vulnerability is documented here and here.

This PR fixes the issue by checking if the alias fields are supposed to be hashed.