Security implications of #66

tdlight-team / tdlight-telegram-bot-api

The TDLight Telegram Bot API is an actively enhanced fork of the original Bot API, featuring experimental user support, proxies, unlimited files size, and more.

https://t.me/TDLight

Boost Software License 1.0

128 stars 27 forks source link

Security implications of #66 #70

Open luckydonald opened 3 years ago

luckydonald commented 3 years ago

With #66 merged, I still have a few points I think we still need to address, and at least document:

I think for security reasons this one would be a quite high priority to solve:

[ ] How can the configuration of that be turned off for the public instances we host?

Additionally it would make sense to write

[ ] A section about proxy support, listing the available methods in the README.

Would be nice for those not looking at the changelog too closely.

davidgfnet commented 9 months ago

Right, it would be good to add a commandline argument to enable/disable this. I agree that it might be good to have it "disabled by default" unless explicitly enabled :/ Will send a PR to add it.