Comments (3)
da3dsoul
commented on June 20, 2024
No offense, but we've got more than a few security issues, which we are slowly working to resolve. For now, we recommend that our users not host Shoko on any public endpoints.
I can enable this feature, as you suggest, but things like possible remote code execution, filesystem access, and a generally bad user system are issues we are aware of.
from shokoserver.
Kwstubbs
commented on June 20, 2024
@da3dsoul Please open Private Vulnerability Reporting and I will submit the report. I am happy to develop a patch to take the work off your hands and give you suggestions on any other vulnerabilities that you know of. This issue is obvious and the fix is quite easy so should not take too long.
from shokoserver.
Kwstubbs
commented on June 20, 2024
Closing
from shokoserver.
Related Issues (20)
- Images pulled from MovieDB inaccessible from desktop app HOT 4
- Null reference exception when anidb group is unknown HOT 1
- Cleanup unused images on Server (future feature-request)
- All episodes are lost and rescanning is broken due to unique constraint HOT 8
- The 'Sync Plex Watch Status' Command Is Not Functioning on Certain Setups HOT 4
- Add a security policy
- Shoko generates different ED2k hash than avdump for 2 files HOT 8
- MySQL Database Connection Error on First Installation of Shoko Server HOT 5
- Sort the directories in the "Select Import Folder" of the WebUI by name (human-readable preferably) HOT 2
- Integrity Check HOT 1
- Blue Exorcist Not Grouping Properly HOT 2
- "Remove Missing Files (Keep in MyList)" action removes entries from MyList HOT 2
- v3/Series/Search Not Returning Results for Search Term: 86 HOT 1
- TypeError: exclusions.split is not a function HOT 2
- Feature Request: Configure number of workers from WebUI HOT 4
- Feature regression relating to the OnFileMatched event HOT 5
- Feature request: Add receive timeout to UDP AniDBSocketHandler HOT 3
- Crash when attempting to index an open read/only file HOT 1
- Feature Request: Ability to decide which sites to use for connectivity testing. HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from shokoserver.