[high] Admin import/export reachable by any logged-in user (main only) #8

New issue

Closed

opened 2026-10-18 15:51:55 +00:00 by jfro · 0 comments

jfro commented

2026-10-18 15:51:55 +00:00

Owner

Severity: high
Affects: main only — fixed on jtk/ebook-management, which ships in v0.6.0, so this closes when that PR merges

Files: lib/fuzzy_catalog_web/router.ex:78-80 on main. The admin scope pipes only :require_authenticated_user; UserAdminAuth.require_admin is defined but never used. Admin LiveViews check in mount, but ImportExportController doesn't check at all (export dumps the whole catalog).
Already fixed on jtk/ebook-management (router adds :require_admin). If the ebook branch doesn't ship, cherry-pick that router change to main.

Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e).

**Severity:** high **Affects:** main only — fixed on jtk/ebook-management, which ships in v0.6.0, so this closes when that PR merges Files: lib/fuzzy_catalog_web/router.ex:78-80 on main. The admin scope pipes only :require_authenticated_user; UserAdminAuth.require_admin is defined but never used. Admin LiveViews check in mount, but ImportExportController doesn't check at all (export dumps the whole catalog). Already fixed on jtk/ebook-management (router adds :require_admin). If the ebook branch doesn't ship, cherry-pick that router change to main. --- _Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e)._

jfro added the

labels

2026-10-18 15:51:55 +00:00

jfro referenced this issue from a pull request that will close it,

2026-10-18 15:53:32 +00:00

feat: ebook libraries, scanning, matching and downloads #17

jfro referenced this issue

2026-10-18 16:27:33 +00:00