Repository navigation
hotfix: close production bleed-through and dashboard auth gaps - #2
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 32b356bb5c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| action = data.get("action") | ||
| guild_raw = data.get("guild_id") | ||
| guild_id = int(guild_raw) if str(guild_raw or "").isdigit() else None |
There was a problem hiding this comment.
POST authorization inspects action, cmd_action, and guild_id only in the JSON body, while APIProxyManager.handle_proxy_request subsequently merges query parameters into the dispatched request. An authenticated user can therefore send /api/proxy?action=proxy_control&cmd_action=guild_settings_save&guild_id=<target> with only settings in the body; these variables are absent during the Manage Guild check but present downstream, so the guild settings update executes without the required permission. The same technique bypasses same-voice checks for player controls.
Useful? React with 👍 / 👎.
| const clientId = /^\d{15,22}$/.test(env.DISCORD_CLIENT_ID || "") | ||
| ? String(env.DISCORD_CLIENT_ID) | ||
| : ""; | ||
| return jsonResponse(request, env, { client_id: clientId }); |
There was a problem hiding this comment.
On Cloudflare Pages, runtime_config is always intercepted here and returns an empty client ID unless the newly introduced DISCORD_CLIENT_ID binding exists, even when VPS_API_URL points to a correctly configured bot whose runtime middleware can provide its identity. Existing deployments have no such documented binding, so security-bootstrap.js leaves CYTECHMUSIC_CLIENT_ID empty and script.js refuses login while the invite page reports that configuration is unavailable. Forward this action to the backend when the edge binding is absent, or support the existing bot-ID configuration.
Useful? React with 👍 / 👎.
| if not config.STRIPE_WEBHOOK_SECRET: | ||
| return web.json_response({"error": "stripe_webhook_not_configured"}, status=503) |
There was a problem hiding this comment.
When STRIPE_API_KEY is configured but STRIPE_WEBHOOK_SECRET is initially absent, Premium.cog_load deliberately runs auto_setup_webhook, which creates a Stripe endpoint and stores its new signing secret in Premium.webhook_secret. This middleware checks only the immutable config value, so it returns 503 before the handler can verify requests with that dynamically provisioned secret; checkout completions are consequently never credited in the repository's automatic webhook-setup mode.
Useful? React with 👍 / 👎.
| elif TOKEN_CLIENT_ID: | ||
| DB_NAME = f"CytechMusic_{TOKEN_CLIENT_ID}" | ||
| else: |
There was a problem hiding this comment.
When DB_NAME is omitted, upgrading an existing deployment now switches MongoDB from the previous automatically selected database—normally the sanitized bot username, with Komo_<client-id> as its token-derived fallback—to CytechMusic_<client-id>. bot.py opens this value directly and there is no migration or lookup of the former name, so all existing guild settings, premium records, playlists, and favorites appear to disappear after the upgrade for deployments that relied on automatic naming.
Useful? React with 👍 / 👎.
1 participant
Security/correctness hotfix for Community Edition after auditing live Cyori first.
Critical changes:
Realtime WebSocket is intentionally disabled in this hotfix until its protocol binds every control frame to an authenticated Discord identity.
This PR is intended to be squash-merged after CI passes.