GitHub 安全公告库 (GHSA)·· 3 小时前AI 评分22
SiYuan authFilePublishAccess 接口可通过响应差异区分文档访问层级并签发 publish-auth cookie
SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden
AI 导读
SiYuan 的 /api/filetree/authFilePublishAccess 接口仅注册 CheckAuth，匿名可达且失败路径从不设置 ret.Code。
来源：GitHub 安全公告库 (GHSA) · github.com