[os-q-feeds-connector] - API requests with empty tokens

Chiusa
  • Qualcosa non va?
#5,735 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
65/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
php, shell
Ambito
api, backend

Direzione di ricerca

The issue is in the Q-Feeds connector plugin. Start by locating the plugin's source code, likely under a directory like 'security/qfeeds-connector'. Examine the script that handles the update command, possibly '/usr/local/sbin/configctl qfeeds update' or a related PHP file. Look for the license request logic and the condition that checks for an empty API key. The fix involves adding a check before making the HTTP request and implementing a persistent backoff mechanism after a 401 response. Test by installing the plugin, leaving the API key empty, and verifying that no requests are made to 'https://api.qfeeds.com/licenses.php'.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

Describe the bug

The Q-Feeds plugin contacts the license endpoint when no API key has been configured. The server correctly rejects the request with HTTP 401, but the connector tries again on later cron runs.

The problem is not limited to the development package. The same behavior is present in older, non-development versions of the plugin.

Authentication works correctly when a valid API key is configured.

To Reproduce

  1. Install the Q-Feeds connector.
  2. Leave the API key empty.
  3. Remove the existing Q-Feeds index file, if one is present.
  4. Run /usr/local/sbin/configctl qfeeds update, or wait for the scheduled update.
  5. The update contacts https://api.qfeeds.com/licenses.php and receives HTTP 401.
  6. Later scheduled updates repeat the request while the API key remains empty.

Expected behavior

When no API key is configured, the connector should not contact the license or feed endpoints. It should wait until an API key has been saved.

After an HTTP 401 response, scheduled updates should use a persistent backoff and should not retry every few minutes.

Screenshots

Not applicable.

Relevant log files

Reproduced on a development firewall with:

  • OPNsense 26.7.4_1 (amd64)
  • os-q-feeds-connector-devel 1.6_1
  • Empty /usr/local/etc/qfeeds.conf

The connector still sent a request to licenses.php, including an Authorization header. The endpoint returned HTTP 401.

The same no-key request path is also present in older, non-development plugin versions.

Additional context

The connector currently starts the license request without first confirming that an API key exists. When the request fails, no new local index is saved. A later scheduled update therefore tries the same request again.

The existing one-hour wait after a 401 only affects the process that received that response. It does not persist between scheduled update processes.

Environment

Verified on:

OPNsense 26.7.4_1 (amd64)
os-q-feeds-connector-devel 1.6_1

Also applies to older, non-development versions of os-q-feeds-connector.

Lingua principale
PHP
Stelle
1.2k
Fork
905
Merge medio
4g 16h
PR unite (30g)
21

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di opnsense/plugins

Tutte le issue di opnsense/plugins

Issue simili

Altre issue su PHP

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.