mirrors/navidrome
1
0
Fork 0
mirror of https://github.com/navidrome/navidrome.git synced 2025-04-04 13:07:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

Fix possible authentication bypass

Browse source
This commit is contained in:
Deluan 2023-12-11 19:32:03 -05:00
parent fd4605d7dc
commit d80e1a260b
2 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
core/auth/auth.go
View file

@ -6,6 +6,7 @@ import (
"time" "time"
"github.com/go-chi/jwtauth/v5" "github.com/go-chi/jwtauth/v5"
"github.com/google/uuid"
"github.com/lestrrat-go/jwx/v2/jwt" "github.com/lestrrat-go/jwx/v2/jwt"
"github.com/navidrome/navidrome/conf" "github.com/navidrome/navidrome/conf"
"github.com/navidrome/navidrome/consts" "github.com/navidrome/navidrome/consts"
@ -23,9 +24,10 @@ var (
func Init(ds model.DataStore) { func Init(ds model.DataStore) {
once.Do(func() { once.Do(func() {
log.Info("Setting Session Timeout", "value", conf.Server.SessionTimeout) log.Info("Setting Session Timeout", "value", conf.Server.SessionTimeout)
secret, err := ds.Property(context.TODO()).DefaultGet(consts.JWTSecretKey, "not so secret") secret, err := ds.Property(context.TODO()).Get(consts.JWTSecretKey)
if err != nil { if err != nil || secret == "" {
log.Error("No JWT secret found in DB. Setting a temp one, but please report this error", err) log.Error("No JWT secret found in DB. Setting a temp one, but please report this error", err)
secret = uuid.NewString()
} }
Secret = []byte(secret) Secret = []byte(secret)
TokenAuth = jwtauth.New("HS256", Secret, nil) TokenAuth = jwtauth.New("HS256", Secret, nil)

2
server/server.go
View file

@ -34,8 +34,8 @@ type Server struct {
func New(ds model.DataStore, broker events.Broker) *Server { func New(ds model.DataStore, broker events.Broker) *Server {
s := &Server{ds: ds, broker: broker} s := &Server{ds: ds, broker: broker}
auth.Init(s.ds)
initialSetup(ds) initialSetup(ds)
auth.Init(s.ds)
s.initRoutes() s.initRoutes()
s.mountAuthenticationRoutes() s.mountAuthenticationRoutes()
s.mountRootRedirector() s.mountRootRedirector()