github-mirror/alist
github-mirror/alist
2
0
Fork 0
mirror of https://github.com/AlistGo/alist.git synced 2025-04-21 20:18:47 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fix(security): compare auth token in constant time (#3740 close #3739)

Browse Source
This commit is contained in:
NewbieOrange 2023-03-06 23:41:06 +08:00 committed by GitHub
parent dd4c97393e
commit d484219c48
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
server/middlewares/auth.go
View File

@ -1,6 +1,8 @@
package middlewares
import (
"crypto/subtle"
"github.com/alist-org/alist/v3/internal/conf"
"github.com/alist-org/alist/v3/internal/model"
"github.com/alist-org/alist/v3/internal/op"
@ -14,7 +16,7 @@ import (
// if token is empty, set user to guest
func Auth(c *gin.Context) {
token := c.GetHeader("Authorization")
if token == setting.GetStr(conf.Token) {
if subtle.ConstantTimeCompare([]byte(token), []byte(setting.GetStr(conf.Token))) == 1 {
admin, err := op.GetAdmin()
if err != nil {
common.ErrorResp(c, err, 500)