ProjectHentai/alist
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): compare auth token in constant time (#3740 close #3739)

Browse Source
This commit is contained in:
NewbieOrange 2023-03-06 23:41:06 +08:00 committed by GitHub
parent dd4c97393e
commit d484219c48
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
server/middlewares/auth.go
View File

@ -1,6 +1,8 @@
package middlewares package middlewares
import ( import (
"crypto/subtle"
"github.com/alist-org/alist/v3/internal/conf" "github.com/alist-org/alist/v3/internal/conf"
"github.com/alist-org/alist/v3/internal/model" "github.com/alist-org/alist/v3/internal/model"
"github.com/alist-org/alist/v3/internal/op" "github.com/alist-org/alist/v3/internal/op"
@ -14,7 +16,7 @@ import (
// if token is empty, set user to guest // if token is empty, set user to guest
func Auth(c *gin.Context) { func Auth(c *gin.Context) {
token := c.GetHeader("Authorization") token := c.GetHeader("Authorization")
if token == setting.GetStr(conf.Token) { if subtle.ConstantTimeCompare([]byte(token), []byte(setting.GetStr(conf.Token))) == 1 {
admin, err := op.GetAdmin() admin, err := op.GetAdmin()
if err != nil { if err != nil {
common.ErrorResp(c, err, 500) common.ErrorResp(c, err, 500)