awakening team mailing list archive

[Szabolcs Molnár <fleet@xxxxxxxxxxxx>]

*** This bug is a security vulnerability ***

Private security bug reported:

The hub required to verify if the ADC commands' originating SID field is
the same as the user's own sid. So users shouldn't be able to talk in
someone else's name.

for example, I can send BMSG ABCD test even if my sid is not ABCD

** Affects: ehub
     Importance: High
         Status: New

** Changed in: ehub
   Importance: Undecided => High

-- 
Need to verify message sources
https://bugs.launchpad.net/bugs/244592
You received this bug notification because you are a member of
Awakening, which is a direct subscriber.

Status in eHub: New

Bug description:
The hub required to verify if the ADC commands' originating SID field is the same as the user's own sid. So users shouldn't be able to talk in someone else's name.

for example, I can send BMSG ABCD test even if my sid is not ABCD