| 标题 | MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df Missing Authentication |
|---|
| 描述 | The affected component is `routes/api.php`, where the entire `files` resource is registered without any authentication middleware, while only the `/api/user` route is protected:
```php
Route::middleware('auth:sanctum')->get('/user', function (Request $request) {
return $request->user();
});
Route::apiResource('files', FileController::class);
```
`app/Http/Controllers/FileController.php` therefore exposes all CRUD operations to unauthenticated callers: `index()` lists every stored file with its name, path, type and size; `store()` uploads files; `update()` renames any file; `destroy()` deletes any file record and its physical file on disk. An unauthenticated attacker can enumerate, upload, rename, and delete all files of the application with plain HTTP requests.
|
|---|
| 来源 | ⚠️ https://github.com/MomoTommy/file-management-system/issues/1 |
|---|
| 用户 | wukong1233333333 (UID 101975) |
|---|
| 提交 | 2026-10-07 16時17分 (15 日前) |
|---|
| 管理 | 2026-10-21 08時55分 (14 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 424693 [MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df Files API FileController.php index/store/update/destroy request 弱身份验证] |
|---|
| 积分 | 20 |
|---|