Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Always check server id when retrieving user data from AccountManagerStore #2587

Merged

Conversation

nielsvanvelzen
Copy link
Member

Side effects

Unfortunately the changes in this PR have some side effects:

  • When the "auto login" option is used and set to a specific user the PR disables it. You need to manually set the user again.
  • When the "auto login" option is used and set to use the last active user, you need to select a user once after updating. No further action is required.

Changes

  • Always check server id when retrieving user data from AccountManagerStore
    • This fixes a security issue when 2 servers use a same user id, this should normally not happen but a malicious server could technically do this. There are no known instances of this happening.

Issues

@nielsvanvelzen nielsvanvelzen added bug Something isn't working backportable Change may be backported to a point release (remove label once cherrypicked) labels Mar 11, 2023
@nielsvanvelzen nielsvanvelzen added this to the v0.15.5 milestone Mar 11, 2023
@nielsvanvelzen nielsvanvelzen force-pushed the auth-server-id-filter branch from 3a5a318 to 208c43c Compare March 11, 2023 18:54
@nielsvanvelzen nielsvanvelzen marked this pull request as ready for review March 11, 2023 18:54
@nielsvanvelzen nielsvanvelzen merged commit 6712eeb into jellyfin:master Mar 12, 2023
@nielsvanvelzen nielsvanvelzen removed the backportable Change may be backported to a point release (remove label once cherrypicked) label Mar 12, 2023
@nielsvanvelzen nielsvanvelzen deleted the auth-server-id-filter branch March 12, 2023 09:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant