mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-08-09 21:05:27 +00:00
470712fdcf
`core.middleware.require_admin` grants admin to any request whose `request.state.current_user == "internal-tool"` — the sentinel meant only for the in-process tool-loopback path. But the normal cookie auth path (app.py) sets `current_user` to the raw username, and neither `create_user` nor the signup route reserved that name. As a result an account literally named "internal-tool" was silently treated as admin by every `require_admin`-gated route. With self-service signup enabled this is an anonymous -> admin privilege escalation. Reserve the full synthetic-owner set the codebase already special-cases — "internal-tool", "api", "demo", "system" (see `_SYNTHETIC_OWNERS` in routes/assistant_routes.py and the matching guards in src/task_scheduler.py and routes/research_routes.py). "api" collides with the bearer-token owner sentinel; "demo"/"system" would leave a real account denied an assistant and inconsistently owner-scoped. Refuse to create or rename into any reserved name (case/space-normalized), and reject empty usernames while we're here. Adds a regression test. Co-authored-by: Claude <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| bombadil-spec.ts | ||
| conftest.py | ||
| test_action_intents.py | ||
| test_agent_loop.py | ||
| test_app.py | ||
| test_auth_event_loop.py | ||
| test_auth_regressions.py | ||
| test_backup_cli_security.py | ||
| test_calendar_owner_scope.py | ||
| test_calendar_recurrence.py | ||
| test_chat_stream_scope.py | ||
| test_chroma_client.py | ||
| test_compare_js.py | ||
| test_context_compactor.py | ||
| test_cookbook_helpers.py | ||
| test_deep_research_extraction_controls.py | ||
| test_endpoint_resolver.py | ||
| test_gallery_image_privileges.py | ||
| test_hwfit_macos.py | ||
| test_llm_core_concurrency.py | ||
| test_llm_core_ollama.py | ||
| test_model_context.py | ||
| test_model_routes.py | ||
| test_null_owner_gates.py | ||
| test_pdf_runtime.py | ||
| test_personal_docs_pdf_index.py | ||
| test_personal_upload_isolation.py | ||
| test_rate_limiter.py | ||
| test_reply_recipients_js.py | ||
| test_research_utils.py | ||
| test_reserved_username_admin_escalation.py | ||
| test_review_regressions.py | ||
| test_search_query.py | ||
| test_search_ranking.py | ||
| test_security_regressions.py | ||
| test_session_mode_helpers.py | ||
| test_settings_scrub.py | ||
| test_setup_admin_user.py | ||
| test_shell_routes.py | ||
| test_task_scheduler_session_delivery.py | ||
| test_vision_model_detection.py | ||
| test_visual_report.py | ||