llvy.ltd/casdoor
1
0
Fork 0
mirror of https://github.com/casdoor/casdoor.git synced 2025-07-03 12:30:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: password leakage vulnerability caused by pagination (#527)

Browse Source 
* fix: password leakage vulnerability caused by pagination

Signed-off-by: Yixiang Zhao <seriouszyx@foxmail.com>

* fix: unsafe get-app-login response fields

Signed-off-by: Yixiang Zhao <seriouszyx@foxmail.com>
This commit is contained in:
Yixiang Zhao
2022-03-02 20:58:16 +08:00
committed by GitHub
parent 2a0dcd746f
commit 83a6b757a4
3 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
object/application.go
View File

@ -217,7 +217,19 @@ func GetMaskedApplication(application *Application, userId string) *Application
if application.ClientSecret != "" {
application.ClientSecret = "***"
}
return application
if application.OrganizationObj != nil {
if application.OrganizationObj.MasterPassword != "" {
application.OrganizationObj.MasterPassword = "***"
}
if application.OrganizationObj.PasswordType != "" {
application.OrganizationObj.PasswordType = "***"
}
if application.OrganizationObj.PasswordSalt != "" {
application.OrganizationObj.PasswordSalt = "***"
}
}
return application
}
func GetMaskedApplications(applications []*Application, userId string) []*Application {