Problem/Motivation

Flagged by Claude Fable:

  Finding 2 — Silent token-ownership reassignment.
  ProcessTokens.php:75 reassigns an existing token to the current user with no audit trail. Deliberate design, but
  combined with any token leak it enables undetectable notification hijack. Minimum fix: log every reassignment with
  old/new uid. Optionally make reassignment configurable

Issue fork push_notifications_registration_tokens-3607847

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

ptmkenny created an issue. See original summary.

ptmkenny opened merge request !70

ptmkenny’s picture

ptmkenny commented
Title: Log token reassignment » Log token owner reassignment

  • ptmkenny committed 27a30964 on 1.0.x 
    task: #3607847 Log token owner reassignment

By: ptmkenny
ptmkenny’s picture

ptmkenny commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.