eisbuk / EisBuk

Manage bookings for ice skating lessons
GNU Affero General Public License v3.0
0 stars 1 forks source link

`queryAuthStatus` and `queryAuthStatus2` are leaking user secret keys #930

Closed silviot closed 7 months ago

silviot commented 7 months ago

Given a user email or phone, an anonymous user can query these functions to get their secret key(s). The functions should check that the authString provided in the request matches the currently logged in used, and return {"result":{"isAdmin":false,"secretKeys":[]}} if they don't.

authString needs to be removed from QueryAuthStatusPayload. The authentication string needs to be pulled from the functions context, as documented here in a similar way to what we already do in other cloud functions.