1.8.1: Bearer tokens on FPM hosts, /mcp hardening, comment moderation authz - #271
Merged
Merged
Conversation
…e sessions; comment moderation gated on a real admin check TIGER-138. Comment_Service_Comment is granted to guests, and _isAdmin() there meant 'allowed on this service' — moderate/datatable/delete-another's were open to anyone with comments enabled. New _isAtLeastAdmin() on the base service; authz before the feature flag. /mcp: reads Authorization from HTTP_/REDIRECT_HTTP_/apache_request_headers (Apache/FPM drops it — the skeleton .htaccess 1.0.21 passes it through); an invalid Bearer is 401; a session is honoured only same-origin; non-JSON is 415. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L8p9pLJ3DFstG3xZuh2QgZ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Findings from the AI-driven web-installer test on host3 (TIGER-138).
_isAdmin()on a guest-granted service means "allowed on this service". NewTiger_Service_Service::_isAtLeastAdmin();moderate/datatable/ delete-another's use it, and answer before the feature flag. Blast radius measured: every other bare_isAdmin()is on an admin/superadmin-granted service./mcpor/apiunder PHP-FPM (Apache drops the header). Skeleton.htaccess1.0.21 passes it through; Tiger readsHTTP_AUTHORIZATION/REDIRECT_HTTP_AUTHORIZATION/apache_request_headers()via one reader./mcp: invalid Bearer → 401; cookie session only same-origin (403 otherwise); non-JSON → 415.Tests: comment suite fixed (it had been moderating as
user) + a refusal test; MCP 401 / redirect-env / 403 / 415. Full suite 2363 green locally.🤖 Generated with Claude Code
https://claude.ai/code/session_01L8p9pLJ3DFstG3xZuh2QgZ