3
0
Fork 0
Commit Graph

5 Commits (6f61c05ee2c976b4e6e637b8cb1b5c648670107d)

Author SHA1 Message Date
Guewen Baconnier 6f61c05ee2 Prevent to send web notifications to other users
Only the admin user (sudo) is allowed to send notifications to other
users. The normal users can only send notifications to themselves.

This is to prevent attackers to craft malicious notifications and send
them to other users using RPC.

Correction based on the idea of @hbrunn
2020-11-05 11:40:14 +01:00
Damien Bouvy 68dd036ba6 [MIG] web_notify: Migration to 11.0
- Use the 'session' class of the JS Framework (session no lounger bound
to web client)
- Test change: compare emitted & received messages based on content, not
order. Using string comparison raises false positives.
2020-11-05 11:40:14 +01:00
Serpent Consulting Services Pvt Ltd 6e8ed7d612 Update web_client.js 2020-11-05 11:40:14 +01:00
Jay Vora(SerpentCS) a13af259b1 [MIG] Migration started web_notify 2020-11-05 11:40:14 +01:00
Pedro M. Baeza 0976846fab [MIG] Make modules uninstallable 2020-11-05 11:40:14 +01:00