IP filter and HTTP auth

[geo-chen]

(details withheld)

[francescayeye]

@geo-chen thanks for the report.
I would have preferred a private communication for a sensible disclosure of the exploit, so to i would be able to release a patched version (eventually removing the feature).

I have no capacity to fix the issue at the moment, also I have to investigate how to apply a fix.
I will put a warning on the homepage of the project

[geo-chen]

@francescayeye sure thing. I can share the poc via email, or through the security advisory feature if you enable it.

[francescayeye]

@geo-chen , I can't find the feature you mentioned. is the POC for a fix or for the exploit?
the exploit is clear on my side and I don't need any POC

[geo-chen]

@francescayeye for exploit - noted.
for security advisory, this is how you can receive security reports privately once enabled: https://github.com/dutchcoders/transfer.sh/security

[francescayeye]

@geo-chen done

[geo-chen]

awesome. created. https://github.com/dutchcoders/transfer.sh/security/advisories/GHSA-h54g-hggh-9q98

[darioackermann]

fyi, your edit history is visible, you might want to remove it

[francescayeye]

fyi, your edit history is visible, you might want to remove it

once again this had to be reported privately
anyway, i can't delete neither the edit history nor the issue