Skip to content

Users can login to other accounts if snowflake matches, does not check for matching site #1248

@ScuffedNewt

Description

@ScuffedNewt

In line 68 on the LoginController.php

$user = UserAlias::where('user_snowflake', $result->id)->first();

this line does not check for matching site and can allow users to login to other accounts if the snowflakes match
we have had this occur on production on another site

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions