Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security Oddity #13

Open
MrRSquared opened this issue Dec 6, 2021 · 1 comment
Open

Security Oddity #13

MrRSquared opened this issue Dec 6, 2021 · 1 comment

Comments

@MrRSquared
Copy link

MrRSquared commented Dec 6, 2021

I accidentally found an odd loophole in the security rules.

If someone who is not an admin manually goes to scouting-.web.app/admin-panel
They can still adjust the game dropdown.
When they do that, it locks the game into that game. No one else has permission to change it. They become the only user able to change the game.

I also am not able to fix it. Admittedly, our database is not completely set up, so it could just be an issue on our end, but it is a potential issue.

@noamzaks
Copy link
Member

Sorry for the slow response, unfortunately I only noticed this now!

I believe I fixed some part of the issue in the latest commit.

Notes:

  • [Fixed] the default is now that someone is not an admin until proven otherwise, where previously (admittedly, we probably wasn't thinking very clearly) someone was an admin until the firebase request went through.
  • In the end, anyone can set their own "angular website" with the firebase config and try to manipulate the application. Most of the actual security lies in the Firestore rules.
  • Indeed the Firestore rules had issues as well! I fixed them in the (now) latest commit.
  • The Firestore "Rules Playground" is very useful to make sure everything is secure.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants