umputun / remark42 / 38125823267

84%

Build Type

push

github

Committed by web-flow

Commit Message

Close the admin takeover through the delete-me link (#2262)

* Render the delete-me result and error as text

The admin approval page wrote the server's response and error into
innerHTML, and both can carry values controlled by the user who asked
to be deleted, so markup in them ran as script in the admin's session.

The page now builds the heading and the details as elements and sets
their text, so nothing the server returns is parsed as HTML.

* Reject delete-me tokens as session credentials

A delete-me token names the user, is signed like a session token and
lives for three months. The comment beside its delete_me attribute said
it could not be used to log in, but nothing checked it, so whoever held
the link could act as that user.

The auth validator now refuses claims carrying delete_me. The admin
deletion handler parses the token itself and keeps accepting it.

* Accept tokens only for the sites this instance serves

The site in a token comes from the login request, and nothing compared
it with the configured sites, so any value got a signed session and was
echoed back in responses and error messages.

With the bolt store the token service now issues and accepts tokens
only for the sites given in --site. A remote store decides on its own
side which sites exist, so with one any audience is still accepted.

The delete-me page fell back to the default site, remark, which an
instance not serving it now refuses. Deletion links carry site_id, the
signed-out message sends the admin to the requesting site's comments,
and the API docs list the site parameter the admin endpoint requires.

* Bump golangci-lint to v2.14.0 in backend CI

CI installs the newest Go 1.27 patch release, now 1.27.2, and
golangci-lint v2.13.2 cannot read its export data, so the lint step
failed with an export data decoding error. v2.14.0, built with Go
1.27.1, reports no issues in backend/app and
backend/_example/memory_store under Go 1.27.2.

* Process a delete-me token only on ... (continued)

Coverage Stats

25 of 25 new or added lines in 3 files covered. (100.0%)

2 existing lines in 1 file now uncovered.

6057 of 7188 relevant lines covered (84.27%)

31.93 hits per line