nextcloud / nextcloud/lookup-server
Insecure API access
Open
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 25
- Forks
- 18
- PR merge metrics
- No merged PRs in 30d
Description
Even if this call didn't handle PII, it should require TLS. There's no reason an internet accessible API should be using HTTP, and many reasons to use HTTPS.
A meta question is where is the impact assessment, code review or other marginalia that led to this decision ?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with server/lib/SignatureHandler.php at line 37, linked in the issue, and trace how the internet-accessible API call is made. The change is complete when the API requires TLS rather than HTTP; no test or further entry point is named in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100