mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-14 14:12:44 +00:00
c4f278c021
/resume resolved a persisted session id/title with no ownership check on any adapter except Matrix, so an authorized caller could bind their gateway session to another user's/room's transcript and read it. The titled-session listing and numeric index were also globally enumerable on non-Matrix platforms, exposing the ids and previews needed to target the IDOR. Generalize the Matrix-only room guard to an adapter-agnostic ownership check (live origin when active; DB row source + user_id for persisted-only sessions, the only fields available), applied to the direct-id/title path and the listing/numeric paths on every platform. An explicit admin --all override is honored. The Matrix path is preserved unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| af.yaml | ||
| de.yaml | ||
| en.yaml | ||
| es.yaml | ||
| fr.yaml | ||
| ga.yaml | ||
| hu.yaml | ||
| it.yaml | ||
| ja.yaml | ||
| ko.yaml | ||
| pt.yaml | ||
| ru.yaml | ||
| tr.yaml | ||
| uk.yaml | ||
| zh-hant.yaml | ||
| zh.yaml | ||