github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-09 20:54:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): require sender-only matching for elevated allowFrom

Browse Source 
Co-authored-by: coygeek <coygeek@users.noreply.github.com>
This commit is contained in:
Peter Steinberger
2026-02-22 20:33:19 +01:00
parent 51b0772e14
commit 02772b029d
3 changed files with 59 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/auto-reply/reply/reply-elevated.ts
View File

@@ -97,8 +97,6 @@ function isApprovedElevatedSender(params: {
addToken(params.ctx.SenderE164);
addToken(params.ctx.From);
addToken(stripSenderPrefix(params.ctx.From));
addToken(params.ctx.To);
addToken(stripSenderPrefix(params.ctx.To));
for (const rawEntry of allowTokens) {
const entry = rawEntry.trim();