-
-
Notifications
You must be signed in to change notification settings - Fork 2.4k
Open
Confirmed Bug
Copy link
Labels
securityThis issue is related to security. This does not necessarily make it high priority.This issue is related to security. This does not necessarily make it high priority.
Milestone
Description
Current Behavior
- Wings allows you to download and delete a denylisted file.
- Wings does not allow you to copy, rename, edit or upload a denylisted file.
- Wings allows you to overwrite a denylisted file by downloading it from a URL.
- Wings does not impose any denylist restrictions on SFTP.
Expected Behavior
- Wings should not allow you to do any operation on denylisted files over the REST API.
- Wings should not allow you to do any operation on denylisted files over SFTP.
Steps to Reproduce
- Edit an egg to add a file to its denylist.
- Try to download the denylisted file - it's allowed.
- Try to rename or copy the denylisted file - it's blocked.
- Try to delete the denylisted file - it's allowed.
- Try doing anything to the file over SFTP - it's allowed.
Panel Version
Not applicable
Wings Version
1.11.11
Games and/or Eggs Affected
No response
Docker Image
No response
Error Logs
No response
Is there an existing issue for this?
- I have searched the existing issues before opening this issue.
- I have provided all relevant details, including the specific game and Docker images I am using if this issue is related to running a server.
- I have checked in the Discord server and believe this is a bug with the software, and not a configuration issue with my specific system.
Metadata
Metadata
Assignees
Labels
securityThis issue is related to security. This does not necessarily make it high priority.This issue is related to security. This does not necessarily make it high priority.