ITADN

croc relay: Room-based join without password

#1104Openabakum 创建于 2026-05-12
A
abakumcommented
### What happened? There is a problem with Croc relays: Client sender CS1 rented a VPS and started a `croc relay` CR. CS1 sent a file to the recipient client CR1 and, in order for CR1 to receive it, told CR1 the password CRP for CR, as well as a secret S that points to a room SR within CR. CR1 can then become CS2 and send files to another CR2 using the same password CRP for CR, without asking the owner CS1 for permission. Solution: In order for CR1 to receive a file from CS1, authorization on CR should be allowed not only using the password CRP, but also using the room name SR. That is, a recipient with an empty password (or pass123) should ask the relay whether room SR exists, and if it does, join it. ### What did you expect to happen? - ### Steps to reproduce - ### croc version - ### Operating System Linux ### OS Version - ### Relevant log output ```shell ``` ### Additional context _No response_
2 条评论