Files
calibre-web/cps
jvoisin 8ad9f4e3b7 Fix a dumb type condition in gdrive.py
hashlib.md5(dbpath) returns a hash object, not a hex string. Comparing a string
(md5Checksum) to a hash object with != always returns True. This means the
DB-replacement code path is always entered, allowing an attacker who sends a
forged notification (with the known static token) to trigger an arbitrary
metadata.db download from GDrive, replacing the live database.
2026-04-14 22:51:36 +02:00
..
2024-11-04 21:20:34 +01:00
2025-11-22 15:06:40 +01:00
2025-04-12 03:59:32 +08:00
2026-02-14 11:30:50 +01:00
2022-05-22 12:49:00 +01:00
2024-09-07 20:07:45 +02:00
2022-05-21 21:52:59 +01:00
2025-03-23 09:18:48 +01:00
2024-06-20 19:12:46 +02:00
2026-02-14 11:30:50 +01:00
2023-01-21 15:23:18 +01:00
2024-07-02 20:53:08 +02:00
2026-02-18 19:11:38 +01:00
2024-12-13 18:03:14 +01:00
2025-03-23 15:12:06 +01:00
2024-07-29 20:08:17 +02:00
2024-07-15 19:38:54 +02:00
2025-03-30 12:03:12 +02:00
2025-12-20 13:22:20 +01:00
2025-11-22 15:06:40 +01:00
2026-03-01 15:44:29 +01:00
2025-03-30 12:03:12 +02:00
2024-11-11 18:46:07 +01:00
2026-02-18 18:59:29 +01:00