mirror of https://github.com/jetkvm/kvm.git
b0494e8eef
CRITICAL SECURITY FIX: Pending sessions (awaiting approval) were granted video.view permission, allowing denied sessions to see video when they reconnected. **Vulnerability:** 1. Session requests access and enters pending mode 2. Primary session denies the request 3. Denied session clicks "Try Again" and reconnects 4. New session enters pending mode but has video.view permission 5. User can see video stream despite being denied **Fix:** Remove PermissionVideoView from SessionModePending. Pending sessions now have NO permissions until explicitly approved by the primary session. This ensures: - Denied sessions cannot access video on reconnection - Only approved sessions (observer/queued/primary) can view video - CanReceiveVideo() properly blocks video frames for pending sessions |
||
|---|---|---|
| .. | ||
| confparser | ||
| hidrpc | ||
| logging | ||
| mdns | ||
| native | ||
| network | ||
| session | ||
| timesync | ||
| tzdata | ||
| udhcpc | ||
| usbgadget | ||
| utils | ||
| websecure | ||