f.weber/homebrewery
0
0
Fork 0
mirror of https://github.com/naturalcrit/homebrewery.git synced 2026-01-06 14:22:52 +00:00
Code Wiki Activity

Merge pull request #3492 from 5e-Cleric/fix-vulnerability-admin-pages

Browse Source 
Fix admin vulnerability to Brute Force
This commit is contained in:
Víctor Losada Hernández
2024-10-10 23:05:06 +02:00
committed by GitHub
parent e3d256aaaf c47974cb49
commit fcede5448e
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
client/homebrew/pages/errorPage/errors/errorIndex.js
View File

@@ -172,6 +172,11 @@ const errorIndex = (props)=>{
**Brew Title:** ${props.brew.brewTitle}`, **Brew Title:** ${props.brew.brewTitle}`,
// ####### Admin page error #######
'52': dedent`
## Access Denied
You need to provide correct administrator credentials to access this page.`,
'90' : dedent` An unexpected error occurred while looking for these brews. '90' : dedent` An unexpected error occurred while looking for these brews.
Try again in a few minutes.`, Try again in a few minutes.`,

3
server/admin.api.js
View File

@@ -2,7 +2,6 @@ const HomebrewModel = require('./homebrew.model.js').model;
const NotificationModel = require('./notifications.model.js').model; const NotificationModel = require('./notifications.model.js').model;
const router = require('express').Router(); const router = require('express').Router();
const Moment = require('moment'); const Moment = require('moment');
//const render = require('vitreum/steps/render');
const templateFn = require('../client/template.js'); const templateFn = require('../client/template.js');
const zlib = require('zlib'); const zlib = require('zlib');
@@ -23,7 +22,7 @@ const mw = {
if(process.env.ADMIN_USER === username && process.env.ADMIN_PASS === password){ if(process.env.ADMIN_USER === username && process.env.ADMIN_PASS === password){
return next(); return next();
} }
return res.status(401).send('Access denied'); throw { HBErrorCode: '52', code: 401, message: 'Access denied' };
} }
}; };