multipleof4/ntfy
1
0
Fork 0
mirror of https://github.com/multipleof4/ntfy.git synced 2026-10-15 16:07:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1795 from lmorchard/fix/sync-topic-deny-all

Browse Source 
Grant users access to their own sync topic under deny-all (fixes #733)
This commit is contained in:
Philipp C. Heckel
2026-06-22 21:17:37 -04:00
committed by GitHub
parent 7b37f2a3eb cac3b2986a
commit 3bfb9f334b
2 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
user/manager.go
+7
View File
@@ -676,6 +676,13 @@ func (a *Manager) Authorize(user *User, topic string, perm Permission) error {
if user != nil && user.Role == RoleAdmin {
return nil // Admin can do everything
}
// A user always has full access to their own sync topic, which the apps use
// to sync subscriptions/settings across devices. Without this, an
// auth-default-access of "deny-all" locks the user out of their own sync
// topic (no ACL entry is created for it at user creation). See #733.
if user != nil && user.SyncTopic != "" && topic == user.SyncTopic {
return nil
}
username := Everyone
if user != nil {
username = user.Name