starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-10-29 08:12:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(auth): shorten g/ owner-check comment

Browse Source 
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ruben Fiszel
2026-05-25 15:52:31 +00:00
co-authored by Claude Opus 4.7
parent 593522033a
commit d8b47f611f
1 changed files with 4 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/windmill-api-auth/src/auth.rs
+4 -12
View File
@@ -302,18 +302,10 @@ impl AuthCache {
None
}
} else if prefix == "g" {
// Checking that the group exists in the
// target workspace is necessary but not
// sufficient: the `all` group is
// provisioned in every workspace, so an
// attacker with token-table write access
// could pair owner=g/all with any
// workspace_id and authenticate as a
// group user there without being a
// workspace member. Additionally require
// that the token holder (by email) is a
// non-disabled member of the target
// workspace, mirroring the u/ branch.
// Group existence alone is not enough: `all` exists in every
// workspace, so owner=g/all would otherwise authenticate any
// forged token against any workspace. Also require the email
// to be a workspace member (WIN-1986).
let group_check = if super_admin {
true
} else {