search

pondersource / sciencemesh-php

Connect your Nextcloud server to Sciencemesh
MIT License
0 stars 1 forks source link

hard coded value for token in NC-Sciencemesh. #87

Open shokri-navid opened 2 years ago

shokri-navid commented 2 years ago

in https://github.com/pondersource/nc-sciencemesh/blob/a03f171434f583917acb2a0a12846cc6bc8476cc/lib/ShareProvider/ScienceMeshShareProvider.php#L244 the token is hardcoded and fixed to "foo", so what should be it? the token handler is commented. this problem is repeated in OC_Sciencemesh as well.

michielbdejong commented 2 years ago

I think it should be a randomly generated string, see also the code that is commented out on that line. I think this is probably the token that somehow becomes the webdav password for the share, and probably also the one that is stored in the database shares table