Skip to content

Conversation

@glensc
Copy link
Contributor

@glensc glensc commented Jul 9, 2020

When submitting data to /run/import add support for token GET parameter, it must match upload.token value from config.

Accompanying change in php-profiler:

@glensc glensc requested a review from markstory July 9, 2020 17:51
@glensc glensc self-assigned this Jul 9, 2020
@glensc glensc marked this pull request as ready for review July 9, 2020 17:53
@glensc
Copy link
Contributor Author

glensc commented Jul 9, 2020

This is a simple solution.

Ideally, there could be multiple tokens for different users.
Also, should do a constant-time comparison of the token to avoid timing attacks.

I'll leave those contributions up to the community.

@glensc glensc force-pushed the upload-token-validation branch from 3d06397 to 485a8aa Compare July 9, 2020 17:55
@glensc glensc force-pushed the upload-token-validation branch from 485a8aa to 517598a Compare July 9, 2020 18:02
@glensc
Copy link
Contributor Author

glensc commented Jul 9, 2020

I messed up with rebasing, and the changeset got to master branch already: dea75a5

@glensc glensc merged commit ba6c53e into perftools:master Jul 9, 2020
@glensc glensc deleted the upload-token-validation branch July 9, 2020 18:07
@glensc glensc added this to the 0.11.0 milestone Jul 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant