heartles/egirlskey
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity

Merge pull request from GHSA-7pxq-6xx9-xpgm

Browse source 
* fix: fix improper authorization when accessing with third-party application

* refactor: refactor type definitions

* fix: get rid of unnecessary access limitation

* enhance: サードパーティアプリケーションがWebsocket APIを使えるように

* fix: add missing parentheses

* Revert "fix(backend): add missing kind definition for admin endpoints to improve security"

This reverts commit 5150053275.

* frontend: 翻訳の抜けを訂正, read:adminとwrite:adminはアクセス発行トークンのデフォルトでは非表示にする

* enhance(test): misskey-ghsa-7pxq-6xx9-xpgmに関するテストを追加

* enhance(test): Websocket APIに対するテストも追加

* enhance(refactor): `@/misc/api-permissions.ts`を`misskey-js/permissions`に統合

* fix(frontend): アクセストークン発行UIで全ての権限を有効にした際、管理者用APIへのアクセスも許可してしまう問題を修正

* enhance(backend): Websocketの接続に最低限必要な権限を変更

* fix(backend): `/api/admin/meta`をサードパーティアプリケーションからはアクセスできないように

* fix(backend): エンドポイントにアクセスするために必要な権限を変更

* fix(frontend/locale): Add missing type declaration

* chore: update `misskey-js/src/autogen`

---------

Co-authored-by: tamaina <tamaina@hotmail.co.jp>
This commit is contained in:
Chocolate Pie 2023-12-27 15:08:59 +09:00 • committed by Marie
parent 6415a789ae
commit 82822e29d9
No known key found for this signature in database
GPG key ID: 56569BBE47D2C828
147 changed files with 795 additions and 579 deletions
Download patch file Download diff file Expand all files Collapse all files

49
locales/index.d.ts vendored
View file

@ -2107,6 +2107,55 @@ export interface Locale {
"write:flash": string;
"read:flash-likes": string;
"write:flash-likes": string;
"read:admin:abuse-user-reports": string;
"write:admin:delete-account": string;
"write:admin:delete-all-files-of-a-user": string;
"read:admin:index-stats": string;
"read:admin:table-stats": string;
"read:admin:user-ips": string;
"read:admin:meta": string;
"write:admin:reset-password": string;
"write:admin:resolve-abuse-user-report": string;
"write:admin:send-email": string;
"read:admin:server-info": string;
"read:admin:show-moderation-log": string;
"read:admin:show-user": string;
"read:admin:show-users": string;
"write:admin:suspend-user": string;
"write:admin:unset-user-avatar": string;
"write:admin:unset-user-banner": string;
"write:admin:unsuspend-user": string;
"write:admin:meta": string;
"write:admin:user-note": string;
"write:admin:roles": string;
"read:admin:roles": string;
"write:admin:relays": string;
"read:admin:relays": string;
"write:admin:invite-codes": string;
"read:admin:invite-codes": string;
"write:admin:announcements": string;
"read:admin:announcements": string;
"write:admin:avatar-decorations": string;
"read:admin:avatar-decorations": string;
"write:admin:federation": string;
"write:admin:account": string;
"read:admin:account": string;
"write:admin:emoji": string;
"read:admin:emoji": string;
"write:admin:queue": string;
"read:admin:queue": string;
"write:admin:promo": string;
"write:admin:drive": string;
"read:admin:drive": string;
"read:admin:stream": string;
"write:admin:ad": string;
"read:admin:ad": string;
"write:invite-codes": string;
"read:invite-codes": string;
"write:clip-favorite": string;
"read:clip-favorite": string;
"read:federation": string;
"write:report-abuse": string;
};
"_auth": {
"shareAccessTitle": string;

49
locales/ja-JP.yml
View file

@ -2012,6 +2012,55 @@ _permissions:
"write:flash": "Playを操作する"
"read:flash-likes": "Playのいいねを見る"
"write:flash-likes": "Playのいいねを操作する"
"read:admin:abuse-user-reports": "ユーザーからの通報を見る"
"write:admin:delete-account": "ユーザーアカウントを削除する"
"write:admin:delete-all-files-of-a-user": "ユーザーのすべてのファイルを削除する"
"read:admin:index-stats": "データベースインデックスに関する情報を見る"
"read:admin:table-stats": "データベーステーブルに関する情報を見る"
"read:admin:user-ips": "ユーザーのIPアドレスを見る"
"read:admin:meta": "インスタンスのメタデータを見る"
"write:admin:reset-password": "ユーザーのパスワードをリセットする"
"write:admin:resolve-abuse-user-report": "ユーザーからの通報を解決する"
"write:admin:send-email": "メールを送る"
"read:admin:server-info": "サーバーの情報を見る"
"read:admin:show-moderation-log": "モデレーションログを見る"
"read:admin:show-user": "ユーザーのプライベートな情報を見る"
"read:admin:show-users": "ユーザーのプライベートな情報を見る"
"write:admin:suspend-user": "ユーザーを凍結する"
"write:admin:unset-user-avatar": "ユーザーのアバターを削除する"
"write:admin:unset-user-banner": "ユーザーのバーナーを削除する"
"write:admin:unsuspend-user": "ユーザーの凍結を解除する"
"write:admin:meta": "インスタンスのメタデータを操作する"
"write:admin:user-note": "モデレーションノートを操作する"
"write:admin:roles": "ロールを操作する"
"read:admin:roles": "ロールを見る"
"write:admin:relays": "リレーを操作する"
"read:admin:relays": "リレーを見る"
"write:admin:invite-codes": "招待コードを操作する"
"read:admin:invite-codes": "招待コードを見る"
"write:admin:announcements": "お知らせを操作する"
"read:admin:announcements": "お知らせを見る"
"write:admin:avatar-decorations": "アバターデコレーションを操作する"
"read:admin:avatar-decorations": "アバターデコレーションを見る"
"write:admin:federation": "連合に関する情報を操作する"
"write:admin:account": "ユーザーアカウントを操作する"
"read:admin:account": "ユーザーに関する情報を見る"
"write:admin:emoji": "絵文字を操作する"
"read:admin:emoji": "絵文字を見る"
"write:admin:queue": "ジョブキューを操作する"
"read:admin:queue": "ジョブキューに関する情報を見る"
"write:admin:promo": "プロモーションノートを操作する"
"write:admin:drive": "ユーザーのドライブを操作する"
"read:admin:drive": "ユーザーのドライブの関する情報を見る"
"read:admin:stream": "管理者用のWebsocket APIを使う"
"write:admin:ad": "広告を操作する"
"read:admin:ad": "広告を見る"
"write:invite-codes": "招待コードを作成する"
"read:invite-codes": "招待コードを取得する"
"write:clip-favorite": "クリップのいいねを操作する"
"read:clip-favorite": "クリップのいいねを見る"
"read:federation": "連合に関する情報を取得する"
"write:report-abuse": "違反を報告する"
_auth:
shareAccessTitle: "アプリへのアクセス許可"