Bug in the nodebb-plugin-link-preview plugin
-
When I am in a chat between users, and send a link to a forum page.
The link does not display the page but automatically redirects to login.
All users who received the link have access to the category, but the category is hidden and not accessible to all forum users.
I hope I understood. -
The link plugin is likely trying to load the category link as a non logged in user and since it's private it doesn't render. @julian
-
@baris I think that's best case.
Link preview accesses as guest and caches it so we wouldn't want to leak any info out accidentally.
-
@baris Indeed, it seems that way, but it must go through identifying the capabilities of that user.
-
@julian Perhaps it is possible to configure that after clicking the link and reaching the login/profile page, the plugin will automatically recognize the connection and redirect to the correct page.
-
@Moshe no that's not what I mean.
If the plugin cached private, sensitive data, that is an information disclosure vulnerability.
The plugin acting as a guest and not a logged in user is a feature, not a bug.
-
Hi, I suddenly find that the link preview plugin no longer works on my nodebb dev and production. What could be the reason?
here seems to be workinh tho
-
@jasonwch is the plugin still active?
./nodebb pluginsAlso links to expand must be made on a separate line
