mirror of
https://github.com/ether/etherpad-lite.git
synced 2025-01-20 22:49:53 +01:00
85b44119ae
The server was reusing the client's message when broadcasting userinfo updates. This would allow a malicious client to insert arbitrary fields into a message that the other clients would trust as coming from the server. For example, adding "disconnect" or renaming other authors. This commit fixes it by having the server construct a new message with known fields before broadcasting. |
||
---|---|---|
.. | ||
db | ||
eejs | ||
handler | ||
hooks | ||
utils | ||
easysync_tests.js | ||
padaccess.js | ||
README.md | ||
server.js |
About the folder structure
- db - all modules that are accesing the data structure and are communicating directly to the database
- handler - all modules that responds directly to requests/messages of the browser
- utils - helper modules
Module name conventions
Module file names start with a capital letter and uses camelCase
Where does it start?
server.js is started directly