From 00421504796110de74683780aae612d707570041 Mon Sep 17 00:00:00 2001 From: tomaioo Date: Thu, 7 May 2026 19:37:49 -0700 Subject: [PATCH] fix(security): missing authorization check on publication analyti (#296) In get_publication_analytics.ts, the code checks if the user has entitlements but does not verify that the user actually owns or has access to the specific publication_uri being queried. Any entitled user could potentially access analytics for any publication. Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- app/api/rpc/[command]/get_publication_analytics.ts | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/app/api/rpc/[command]/get_publication_analytics.ts b/app/api/rpc/[command]/get_publication_analytics.ts index 8b5e68a2..20825305 100644 --- a/app/api/rpc/[command]/get_publication_analytics.ts +++ b/app/api/rpc/[command]/get_publication_analytics.ts @@ -41,6 +41,10 @@ export const get_publication_analytics = makeRoute({ return { error: "not_found" as const }; } + if (publication.identity_did !== identity.atp_did) { + return { error: "unauthorized" as const }; + } + const domains = (publication.publication_domains ?? []) .map((d) => d.domain) .filter(Boolean) -- 2.51.2