Page 1 of 1
user json superuser data
Posted: Sunday 25 November 2018 20:30
by luberth
Hello
Find it a bit strange
if a user looks at json data
he can see the superuser readable name
and coded password
bit strange???
Re: user json superuser data
Posted: Sunday 25 November 2018 22:34
by waaren
luberth wrote: ↑Sunday 25 November 2018 20:30
if a user looks at json data he can see the superuser readable name and coded password
What did you put in the [settings] [system] [Local Networks (no username/password):] field ?
Re: user json superuser data
Posted: Monday 26 November 2018 8:12
by luberth
Hello
Is empty no text
Setup=>Settings
- local_networks.png (9.83 KiB) Viewed 597 times
point is cq how i look at it
i am sharing my floorplan for others to see
..........
would be nice for inspiration iff more people do
they can only watch
when they click a switch they get =>
you do not have permission to do that
but if someone with more knowledge as me
and knowing above user view only login
views the json
he or maybe even she can see superuser username in plain text
and coded password
i think there would be guys or even girls knowing how to uncode that password
and in they are
in my opinion the viewonlyuser should not see the superuser info in json with his rights
i watch a particular json(do not go into detail here,advanced domoticz json users will know wich one) with an online viewer
http://jsonviewer.stack.hu/
so its got nothing to do with local adres viewing
setup=>more options =>edit users
add an [ ]option jsonview allowed ?????
This makes vieweronly user test password test
http://test:[email protected]:8080/#/Floorplans
but this user should not be allowed to see almost all superuser info in json
- domoticz_user.png (36.66 KiB) Viewed 602 times
Re: user json superuser data
Posted: Tuesday 27 November 2018 12:03
by luberth
Hmmmmm
My 433mhz Doorbell started playing
Somebody in???
how did you do that?
no de doorbell log shows no on action
must be false reception by cheap doorbell
there must be some similarity between 433mhz code of action impuls wall socket and action doorbel
./impuls.sh 31 C on 10
Re: user json superuser data
Posted: Tuesday 27 November 2018 14:18
by waaren
luberth wrote: ↑Monday 26 November 2018 8:12
Hello
Is empty no text
Setup=>Settings
local_networks.png
point is cq how i look at it
i am sharing my floorplan for others to see
..........
would be nice for inspiration iff more people do
they can only watch
when they click a switch they get =>
you do not have permission to do that
but if someone with more knowledge as me
and knowing above user view only login
views the json
he or maybe even she can see superuser username in plain text
and coded password
i think there would be guys or even girls knowing how to uncode that password
and in they are
in my opinion the viewonlyuser should not see the superuser info in json with his rights
i watch a particular json(do not go into detail here,advanced domoticz json users will know wich one) with an online viewer
http://jsonviewer.stack.hu/
so its got nothing to do with local adres viewing
setup=>more options =>edit users
add an [ ]option jsonview allowed ?????
This makes vieweronly user test password test
http://test:[email protected]:8080/#/Floorplans
but this user should not be allowed to see almost all superuser info in json
domoticz_user.png
I understand now. Already possible to see your complete configuration including device attributes (name, description, etc...).
Not enough authorization to control them with API calls but too open for my liking.
Re: user json superuser data
Posted: Tuesday 27 November 2018 14:48
by luberth
Sorry im just a Domoticz newbie beginner
..........so my configuration looks like .....
and u can see
_____superuser name in plaintext => thats 1 guess less, and a huge loss for owner or big win for the hacker
_____and coded password
if u use the right json call
also you can see notification email adresses etcetera
much to much for this view only viewer
Re: user json superuser data
Posted: Sunday 30 December 2018 9:18
by luberth
disappointed
that there is no reaction from forummanagers or programmers