Mirrors/MeshCore-Solo
1
0
Fork 0
mirror of https://github.com/MarekZegare4/MeshCore-Solo.git synced 2026-11-02 10:51:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): a kept route no longer grants the contact remote CLI

Browse Source 
CONTACT_FLAG_ROUTE_PINNED was bit 4 (0x10) of ContactInfo::flags, which
upstream 1.18 made isRemoteCLIAllowed(): keeping a route to a contact let it
run any CLI command on the device remotely (radio, name, PIN, reboot,
wifi.pwd), and a contact the app allowed CLI had its route held. The kept
route moves to bit 7 (0x80). Not in any release (the route editor came
after rc3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Jakub
2026-10-15 15:42:14 +02:00
co-authored by Claude Opus 5.5
parent ad8e3f859f
commit 0346cebaf6
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/helpers/ContactInfo.h
+5 -4
View File
@@ -5,11 +5,12 @@
#define OUT_PATH_UNKNOWN 0xFF
// ContactInfo::flags bit 4: the route in out_path was set by hand (the device's
// ContactInfo::flags bit 7: the route in out_path was set by hand (the device's
// Route editor) and is kept: a path heard from the contact, or a message that
// goes unanswered, doesn't replace it. Bit 0 is the favourite star, bits 1-3 the
// telemetry permissions. Reset path (or a new route saved) clears / sets it.
#define CONTACT_FLAG_ROUTE_PINNED 0x10
// goes unanswered, doesn't replace it. Reset path (or a new route saved) clears
// / sets it. Upstream's bits, below: 0 the favourite star, 1-3 the telemetry
// permissions, 4 remote CLI -- the top bit is the one furthest from theirs.
#define CONTACT_FLAG_ROUTE_PINNED 0x80
struct ContactInfo {
mesh::Identity id;