16 lines
1.0 KiB
Markdown
16 lines
1.0 KiB
Markdown
# glance — triage (pin glanceapp/glance:v0.8.5)
|
|
|
|
Template: `family_gate: true` (only signed-in household members reach it). Seeded glance.yml has NO `auth:` block (Glance has no login of its own here).
|
|
|
|
## Notices (1 GHSA)
|
|
- GHSA-r225-jhr6-68cc (high, >= 0.8.0 <= 0.8.6, fixed 0.8.7): unbounded body read on POST /api/authenticate.
|
|
NOT-A-FINDING: the route is registered only `if a.RequiresAuth` (internal/glance/glance.go @ v0.8.5 line 453-456); our seeded config
|
|
enables no auth, so the endpoint does not exist. Even if a household adds auth, the family gate keeps strangers out.
|
|
Real 0 / 1.
|
|
|
|
## Fix
|
|
None required. Optional routine bump: `glanceapp/glance:v0.8.7` (Hub tag exists). Same main (0): yes. v0.8.7 note: Reddit widget `search`
|
|
property needs `app-auth` now (our seed uses no reddit widget). v0.8.6: XFF rate-limit spoof fix (auth only).
|
|
Lane: NOT_A_FINDING.
|
|
Classifier note: GHSA-r225 applies only when Glance auth is configured; the watch cannot see the household's glance.yml, but for the catalog default it is not reachable.
|