Patreon's signed download links go to every open page and the log #292
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Event::redacted (crates/ipx/src/ipc.rs) strips the query from DownloadError, TorrentDeferred and FeedMoved addresses (#238), but Progress and DownloadDone keep their url whole. Both are broadcast to every signed-in page, whoever's feed it is, and logged at info. Seen in production's log 2026-10-19 16:45 UTC: download_done for gcn-news-minute with url https://www.patreon.com/api/rss/u//e/172810037.mp3?sig=. Query: {container="iPX"} |= ""ev":"download_done"" |~ "\?[a-zA-Z_-]+=". Found in a repo audit. Fix: redact url in those two arms too, and add them to what_goes_out_names_no_private_feeds_key. The page does not read url from either event.
Fixed in
c1d8983: Event::redacted strips the query from Progress and DownloadDone addresses too, and what_goes_out_names_no_private_feeds_key covers both. A Patreon file's path still carries its per-account segment, as DownloadError's always has. Deployed in ipx.