updated to fix critical bug (#2424)

Co-authored-by: Kevin B. <kurami32_kbm@proton.me>
Co-authored-by: Stephan Paternotte <Stephan-P@users.noreply.github.com>
Co-authored-by: Nebula <40148908+nebula-it@users.noreply.github.com>
Co-authored-by: Juan Soler <juansoler@gmail.com>

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to this project will be documented in this file. For commit guidelines, please refer to [Standard Version](https://github.com/conventional-changelog/standard-version).
 
+## v1.4.1
+
+ **Security**:
+ - Fix critical: unauthenticated user can view source info
+
 ## v1.4.0
 
  **New Features**:

backend/common/settings/settings.go

@@ -133,6 +133,10 @@ func ApplyUserDefaults(u *users.User) {
 	// FileLoading settings
 	u.FileLoading = d.FileLoading
 
+	if u.Username == "anonymous" {
+		return
+	}
+
 	// Permissions
 	u.Permissions.Api = d.Account.Permissions.Api
 	u.Permissions.Admin = d.Account.Permissions.Admin
@@ -147,7 +151,7 @@ func ApplyUserDefaults(u *users.User) {
 		u.LoginMethod = users.LoginMethod(d.Account.LoginMethod)
 	}
 
-	if len(u.Scopes) == 0 && u.Username != "anonymous" {
+	if len(u.Scopes) == 0 {
 		for _, source := range Config.Server.Sources {
 			if source.Config.DefaultEnabled {
 				u.Scopes = append(u.Scopes, users.SourceScope{