search

calzoneman / sync

Node.JS Server and JavaScript/HTML Client for synchronizing online media
Other
1.46k stars 235 forks source link

Option to turn off IP addresses in tooltip for admins #881

Closed lewisakura closed 4 years ago

lewisakura commented 4 years ago

Author's note: anything I've crossed out is not applicable to this issue.

Please fill out the templates below to the best of your ability, based on whether your problem is with using the website or with running your own server.

Website Problem

Please confirm whether you've tried the following debugging steps:

Description of the Problem

System Information

On Firefox, press Ctrl+Shift+K to open the JavaScript console. On Chrome, press Ctrl+Shift+J.

calzoneman commented 4 years ago

Can you clarify the motivation? There are probably a dozen different ways a site administrator could reveal a user's IP address; why are you concerned about this one in particular?

In general, CyTube's threat model assumes those with site administrator rank are trustworthy. Changing that threat model would be a much bigger task.

On Tue, Jul 14, 2020, 10:35 Lewis Crichton notifications@github.com wrote:

Author's note: anything I've crossed out is not applicable to this issue.

Please fill out the templates below to the best of your ability, based on whether your problem is with using the website or with running your own server. Website Problem

Please confirm whether you've tried the following debugging steps:

  • [ ] Clearing cache and refreshing the page (On Firefox, press Ctrl+F5. On Chrome, press F12, then right click the refresh button and click "Empty Cache and Hard Reload")
  • [ ] Disabling all browser extensions
  • Using a clean channel with no customizations

Description of the Problem

  • What triggers the problem? Hovering over a user to reveal the tooltip
  • What happens? Shows the IP address of the user
  • What do you expect to happen instead? Have an option to turn it off

System Information

  • Operating System (Windows / Mac / Linux / Android / iOS):
  • Web Browser (Firefox / Chrome / Other):
  • Error Messages Displayed:
  • Screenshot of JavaScript Console:

On Firefox, press Ctrl+Shift+K to open the JavaScript console. On Chrome, press Ctrl+Shift+J.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/calzoneman/sync/issues/881, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAC6FCG4YDBOXAYSVPBMQOTR3SJMJANCNFSM4OZXTL7A .

lewisakura commented 4 years ago

My instance is specifically for a Twitch streamer and their fans. Having the IPs being revealed to the public via an accidental hover is a decent risk when live, so I was looking for an option to disable it.

Edit: I was more specifically looking for this to be a user option so admins can turn it off if they want to.

Xaekai commented 4 years ago

So this is an accidental disclosure concern, for a streamer. That seems sensible enough. The block that shows IP in user profile popups is scaffolded here. Adding a class to it to make it an easy target for a stylesheet selector seems like the ideal approach.

calzoneman commented 4 years ago

Thank you for explaining. An easy way for you to patch this out would be to edit this line: https://github.com/calzoneman/sync/blob/3.0/src/channel/channel.js#L542

If it becomes a popular feature request, we can add it upstream.

lewisakura commented 4 years ago

I'll most likely write up a PR for this, give me a bit to learn how the codebase works and I'll have one ready in no time.