Appwrite/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite.git synced 2026-05-26 13:51:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Guard consoleApiKey to same-instance migrations only

Browse Source 
Revert controller to original form without console API key generation
to avoid leaking JWT to untrusted remote endpoints. In the worker,
only set consoleApiKey when the source endpoint matches the local
endpoint, ensuring the locally-signed JWT is never sent cross-instance.
This commit is contained in:
Prem Palanisamy
2026-02-12 16:30:57 +00:00
parent 4350bda137
commit 86ea75026f
2 changed files with 8 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/api/migrations.php
+1 -12
View File
@@ -1,6 +1,5 @@
<?php
use Ahc\Jwt\JWT;
use Appwrite\Event\Event;
use Appwrite\Event\Migration;
use Appwrite\Extend\Exception;
@@ -719,17 +718,7 @@ Http::get('/v1/migrations/appwrite/report')
->inject('user')
->action(function (array $resources, string $endpoint, string $projectID, string $key, Response $response) {
$consoleApiKey = '';
$openSslKey = System::getEnv('_APP_OPENSSL_KEY_V1');
if (!empty($openSslKey)) {
$jwt = new JWT($openSslKey, 'HS256', 86400, 0);
$consoleApiKey = API_KEY_DYNAMIC . '_' . $jwt->encode([
'projectId' => 'console',
'scopes' => ['platforms.read', 'keys.read'],
]);
}
$appwrite = new Appwrite($projectID, $endpoint, $key, consoleApiKey: $consoleApiKey, sourceProjectId: $projectID);
$appwrite = new Appwrite($projectID, $endpoint, $key);
try {
$report = $appwrite->report($resources);
src/Appwrite/Platform/Workers/Migrations.php
+7 -1
View File
@@ -385,7 +385,13 @@ class Migrations extends Action
$credentials['projectId'] = $credentials['projectId'] ?? $project->getId();
$credentials['apiKey'] = $credentials['apiKey'] ?? $tempAPIKey;
$credentials['endpoint'] = $credentials['endpoint'] ?? $endpoint;
$credentials['consoleApiKey'] = $credentials['consoleApiKey'] ?? $tempConsoleAPIKey;
// Only set consoleApiKey for same-instance migrations to avoid
// leaking a locally-signed JWT to untrusted remote servers
if (($credentials['endpoint'] ?? '') === $endpoint) {
$credentials['consoleApiKey'] = $tempConsoleAPIKey;
$credentials['sourceProjectId'] = $credentials['projectId'];
}
}
if ($migration->getAttribute('destination') === DestinationAppwrite::getName()) {