From fe461836b41c22b2ff3684270f73c3463b46ff42 Mon Sep 17 00:00:00 2001 From: anupamme Date: Sat, 26 Sep 2026 01:42:47 +0000 Subject: [PATCH] fix: multi_agent.cwe-306 security vulnerability Automated security fix generated by OrbisAI Security --- config/server.js | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/config/server.js b/config/server.js index a91946e25..fb5708e1b 100644 --- a/config/server.js +++ b/config/server.js @@ -99,7 +99,16 @@ app.post("/login", function (req, res) { loginURI(req, res) }) +function checkAuthentication(req, res) { + if (hasEnabledAuthentication() && !getLastconnection()) { + res.status(401).send("Authentication required") + return false + } + return true +} + app.get("/config", function (req, res) { + if (!checkAuthentication(req, res)) return configURI(req, res) }) @@ -109,6 +118,7 @@ const mockContext = { } app.get("/command", function (req, res) { + if (!checkAuthentication(req, res)) return const url = req.query.cmd != null ? req.query.cmd : req.originalUrl if (MOCK_VERBOSE) console.log(commandcolor(`[server]/command ${url}`)) commandsQuery(req, res, SendWS, mockContext)