cloudflare/wildebeest

Private messages are included on local timeline

koehn opened this issue · 15 comments

koehn commented
  1. From the Mastodon client, create a Toot.
  2. Set the audience to “only people I mention” and mention someone, and send the message
  3. Go to the main https page for your site (e.g., https://example.com/explore) and select “Local” from the list on the right
  4. Your private messages are displayed there
ThatOneCalculator commented

Lol. Lmao.

  • 😄9
Sqaaakoi commented

When will the feature be renamed to Public Messages?

spacekookie commented

you've got nothing to hide

richfelker commented

Has anyone clarified whether this is only visible logged in as yourself (laughably bad ux that could be panic inducing for users, but not actually a privacy leak) or publicly?

WesleyAC commented

took a peek at the code and it looks like there is no attempt at authentication or filtering, lol

  • 😄11
  • 🎉2
WesleyAC commented

it's also real cool and good to assemble the sql statements with string interpolation. afaict that doesn't cause any sql injection problems in the current code, but as soon as there's a path that calls getObjectBy with a attacker-controlled key or something like that there's gonna be problems.

definitely not a sign of half baked software rushed to ship or anything like that!

  • 😄3
EvelynSubarrow commented

I suppose this is an innovative solution to the "Mastodon admins can read your DMs" controversy, but possibly not the one I'd have picked

  • 😄1
ThatOneCalculator commented

Is this the part where I start to shill other Fedi software?

xtuc commented

Currently private messages are not supported, they might be displayed on public timelines. I temporarly locked this issue to avoid spam.

  • 👎1
  • 😄4
EvelynSubarrow commented

Would I be correct in thinking that incoming private messages (and not just outgoing private messages) would be publicly available?

jae1911 commented

The whole fediverse to CF rn:

videoplayback.mp4
  • 😄1
xtuc commented

Locking the issue permanently.

As I said in #303 (comment). At the moment, private messages are not supported and we are well aware. Our team is looking into it.

Thanks for the issue @koehn. Feel free to reach out to me directly on Discord for concerns / questions.

xtuc commented

A fix has been merged. Private messages sent from Wildeebest are not showing in public timelines anymore. Please sync your forks to patch your instance.

Also note that, for safety, toots with private or unlisted visbility are now rejected until we implement them properly.

In the future, issues that could be security related can be reported via https://github.com/cloudflare/wildebeest/blob/main/SECURITY.md.

Closing this since the original issue has been addressed.