Web Lacre accepts any string in key submission field #41

New Issue

Closed

opened 2021-11-02 15:35:39 +01:00 by muppeth · 1 comment

muppeth commented

2021-11-02 15:35:39 +01:00

Owner

Looks like putting anything in the field is accepted by lacre. We should improve on that and allow only strings that are gpg valid as keys, otherwise I smell potential for trolling and abuse.

Aditionally we could prevent situation where someone did not copy they jey properly etc.

Looks like putting anything in the field is accepted by lacre. We should improve on that and allow only strings that are gpg valid as keys, otherwise I smell potential for trolling and abuse. Aditionally we could prevent situation where someone did not copy they jey properly etc.

muppeth added this to the mailgate web improvements milestone 2021-11-02 15:35:39 +01:00

muppeth added the

BUG

DEVELOPMENT

CODE

labels 2021-11-02 15:35:39 +01:00

muppeth self-assigned this 2021-11-02 15:35:39 +01:00

pfm was assigned by muppeth

2021-11-02 15:35:39 +01:00

muppeth commented

2021-11-04 13:12:24 +01:00

Author

Owner

Looks like PEBKAC on my end. There is of course option in the config which checks keys right away when submitting in the web interface. $config['pgpverify_enable'].

Looks like PEBKAC on my end. There is of course option in the config which checks keys right away when submitting in the web interface. ` $config['pgpverify_enable']`.

muppeth closed this issue

2021-11-04 13:12:53 +01:00