Impact
Tobira generates RSS feeds for each series and playlist. That feed contains metadata of the series/playlist as well as the videos contained in it. For each video, it includes metadata, thumbnail and links to video tracks.
Tobira did not perform any authorization checks before handing out this information, allowing unauthorized users (including users not logged in) to retrieve that information; as long as they get the Tobira series or playlist ID.
Patches
This is patched in v3.10.
Workarounds
You can block all requests with a path starting with /~rss in your reverse proxy.
References
- #791 (original feature request)
- #959 (original implementation)
Impact
Tobira generates RSS feeds for each series and playlist. That feed contains metadata of the series/playlist as well as the videos contained in it. For each video, it includes metadata, thumbnail and links to video tracks.
Tobira did not perform any authorization checks before handing out this information, allowing unauthorized users (including users not logged in) to retrieve that information; as long as they get the Tobira series or playlist ID.
Patches
This is patched in v3.10.
Workarounds
You can block all requests with a path starting with
/~rssin your reverse proxy.References