search

danielmarschall / oidplus

OIDplus 2.0 - An OpenSource online Registration Authority for OIDs and other Object Types
https://www.oidplus.com
Apache License 2.0
10 stars 6 forks source link

Security: Invitation page abuse #27

Closed danielmarschall closed 9 months ago

danielmarschall commented 9 months ago

It is possible that anyone can receive an invitation, even if they were not assigned as RA to any object, just by entering "oidplus:invite_ra$xx$..." in the goto box. It should be somehow secured.

danielmarschall commented 9 months ago

It turns out that this is already implemented with the method inviteSecurityCheck()

The admin itself may invite everyone, even people who have no OID (yet).

So everything's good. No security risk.