Weblate · Report #229620
Information Disclosure on demo.weblate.org
Summary
I discovered a smal, but still sensitive information disclosure in the https://demo.weblate.org The user, who logged in with a demo account, was able to watch IP-adresses of the previous visitors. As a solution, audit log was removed from demo account.
How it was found
Description
The demo instance, located on https://demo.weblate.org is leaking user's IP-adresses in the Activity log. {F185728}
Impact
The authenticated user can disclose valid IP adresses of other users through Activity log. The feature works as it should (so no changes should be made on the GitHub or other sites like hosted.weblate.org), but i still recommend you to hide IPs that do not belong to the user only on this particular instance, because user do not know before login, that his IP will become accessible to the public.
Reproduction Steps
- Login at the https://demo.weblate.org as demo:demo
- Go to the https://demo.weblate.org/accounts/profile/#audit
Suggested fix
The sensitive information can be hided in various ways - for example x.x.x.x or similar. It do not require code changes on your GitHub repositories, just in this particular instance.