github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-09-10 14:09:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

🐛 Use random UUIDs for share link IDs (#11117)

Browse Source 
Share link IDs function as capability secrets — anyone possessing
the ID can read a file without authentication. The previous UUIDv8
scheme is predictable (56 bits fixed per process + 48-bit timestamp).

Changed to uuid/random (UUIDv4) for genuine unpredictability.

Closes #11116

AI-assisted-by: qwen3.7-plus
This commit is contained in:
Andrey Antukh 2026-08-07 11:27:12 +02:00 committed by GitHub
parent 6951876c13
commit 5571c53502
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
backend/src/app/rpc/commands/files_share.clj
View File

@ -43,7 +43,7 @@
[conn {:keys [profile-id file-id pages who-comment who-inspect]}] [conn {:keys [profile-id file-id pages who-comment who-inspect]}]
(let [pages (db/create-array conn "uuid" pages) (let [pages (db/create-array conn "uuid" pages)
slink (db/insert! conn :share-link slink (db/insert! conn :share-link
{:id (uuid/next) {:id (uuid/random)
:file-id file-id :file-id file-id
:who-comment who-comment :who-comment who-comment
:who-inspect who-inspect :who-inspect who-inspect