mirror of
https://github.com/EasyTier/EasyTier.git
synced 2026-08-06 04:29:52 +00:00
Moder Steven
346f32d3d0
handle_list_all_sessions returned client_mgr.list_sessions(), which iterates user_clients_map across ALL users and returns every session's StorageToken (token, client_url, machine_id, user_id). The handler is mounted under login_required! but performed no per-user authorization: it fetched get_group_permissions() only to println! the result, then returned the full cross-user list. Any authenticated user could read every other user's device token and public client_url. Scope the result to the caller by adding Storage::list_user_client_tokens(user_id) / ClientManager::list_sessions_by_user_id(user_id), mirroring the existing per-user pattern in handle_get_summary (list_machine_by_user_id). Also drop the leftover debug println! and the unwrap() on the current user (return 401 instead).