feed-me icon indicating copy to clipboard operation
feed-me copied to clipboard
verified publisher icon craftcms

Duplicating a feed does not change the passkey on the new feed created

Open jamesmacwhite opened this issue 1 year ago • 2 comments

Description

When duplicating a feed the passkey is copied from the existing feed. Depending on how you view the use/purpose of the passkey, it is technically there to provide an extra layer of security in addition to just being able to pass a feed ID from a web request to a trigger a feed import. Having it not changed from an existing feed could be seen as potentially a security issue if you have a passkey for another feed and just increment the ID to try and guess or enumerate.

Not a bug technically but perhaps something that can be reviewed?

Steps to reproduce

  1. Duplicate an existing Feed Me feed
  2. The passkey value provided will be the same from the original feed

Additional info

  • Craft version: 5.4.6
  • PHP version: 8.3.8
  • Database driver & version: MySQL
  • Plugins & versions: Feed Me 6.4.0

jamesmacwhite avatar Oct 03 '24 17:10 jamesmacwhite

As the field helper references it as a unique string, the duplication action contradicts that. Image

jamesmacwhite avatar Oct 03 '24 18:10 jamesmacwhite

Hi, thanks for reporting! I raised a PR for this.

i-just avatar Oct 15 '24 07:10 i-just

Feed Me 5.8.2 and 6.5.0 are out with this change.

i-just avatar Oct 28 '24 10:10 i-just

@i-just Thank you!

jamesmacwhite avatar Oct 29 '24 12:10 jamesmacwhite