search

systopia / CiviProxy

A security proxy for CiviCRM
GNU Affero General Public License v3.0
7 stars 18 forks source link

Entity and Action name in the API whitelist are case sensitive #33

Closed jaapjansma closed 7 months ago

jaapjansma commented 4 years ago

The entity and action specification in the api white list are case sensitive. So meaning that when Contact.get is whitelisted but I present it to CiviProxy as contact.Get (mark the case switch). It is not allowed.

Is this desiered behaviour? Or should the white list be case insensitive?

bjendres commented 4 years ago

@jaapjansma: You're right, they shouldn't be case sensitive. Or can you think of a way of exploiting this?

jaapjansma commented 4 years ago

I dont see any risk of the action and entity being case insensitive.

bjendres commented 4 years ago

Then let's change it.

jaapjansma commented 4 years ago

I am working on it. Might have a fix later on this afternoon