Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Duplicating a feed does not change the passkey on the new feed created #1526

Open
jamesmacwhite opened this issue Oct 3, 2024 · 1 comment
Labels

Comments

@jamesmacwhite
Copy link
Contributor

Description

When duplicating a feed the passkey is copied from the existing feed. Depending on how you view the use/purpose of the passkey, it is technically there to provide an extra layer of security in addition to just being able to pass a feed ID from a web request to a trigger a feed import. Having it not changed from an existing feed could be seen as potentially a security issue if you have a passkey for another feed and just increment the ID to try and guess or enumerate.

Not a bug technically but perhaps something that can be reviewed?

Steps to reproduce

  1. Duplicate an existing Feed Me feed
  2. The passkey value provided will be the same from the original feed

Additional info

  • Craft version: 5.4.6
  • PHP version: 8.3.8
  • Database driver & version: MySQL
  • Plugins & versions: Feed Me 6.4.0
@jamesmacwhite
Copy link
Contributor Author

jamesmacwhite commented Oct 3, 2024

As the field helper references it as a unique string, the duplication action contradicts that.
Image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant