upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-02-20 00:12:30 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 14

fix: treat text app session parameters as sensitive values

Browse source 
* `PublicSessionController create` receives a share token.
* The others receive the parameters for a text session:
  `document_id`, `session_id`, `session_token`.
  Even though these are relatively short lived
  they could be used to retrieve content from the document when leaked.

Signed-off-by: Max <max@nextcloud.com>
This commit is contained in:
Max 2023-03-01 13:03:47 +01:00
parent 416efc12d6
commit 95a674e238
No known key found for this signature in database
GPG key ID: 0F5BFA367A00BACE
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
lib/private/Log/ExceptionSerializer.php
View file

@ -100,6 +100,16 @@ class ExceptionSerializer {
// Preview providers, don't log big data strings
'imagecreatefromstring',
// text: PublicSessionController, SessionController and ApiService
'create',
'close',
'push',
'sync',
'updateSession',
'mention',
'loginSessionUser',
];
/** @var SystemConfig */