CalvinBackup/deflock
1
0
Fork 0
mirror of https://github.com/FoggedLens/deflock.git synced 2026-07-14 15:57:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

remove username as public input from /sponsors/github

Browse Source 
Extends the previous commit's fix. The only caller (Donate.vue via
apiService.getSponsors()) never sends a username and always relied on the
server-side default, so the parameter had no legitimate use even after
being parameterized — it just let anyone use deflock's server as an
unauthenticated relay onto GitHub's GraphQL API under the server's own
token. Drop it entirely: the route no longer accepts a username
querystring param, and GithubClient.getSponsors() takes no argument,
hardcoding the maintainer's login via MAINTAINER_USERNAME. Keeps the
$username GraphQL-variable parameterization technique so reintroducing a
variable input later can't reintroduce the injection.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Chris Bowles
2026-07-08 02:33:12 -04:00
parent 3eceedb9c6
commit 34e2cbdc2d
4 changed files with 61 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/README.md
+1 -1
View File
@@ -4,7 +4,7 @@ A Fastify-based API service for DeFlock handling non-OSM related backend logic.
## Endpoints
- `/geocode?query=...` — Geocode a location
- `/sponsors/github?username=...` — Get GitHub sponsors
- `/sponsors/github` — Get GitHub sponsors
- `/healthcheck` — Health check
## Development