Security concern for the V5.11 Log feature in demo

hypoclone 2 years ago

Hello! I logged into one of the traccar demo server to check the new log features, I could see raw data from many devices coming in, this data exposes device ID which any registered user can see.

SwayDev 2 years ago

That is a good catch. Logged in and yeah I am able to see other devices logs.

I cant validate, however if Click on the ? icon and edit the devices name, it also edits the name (the console, when I checked API response of /devices) the device object now contains the name i edited it too.

Although I do not have this device in my account. (demo4, device id :10093) edited name to "ss" (Sorry, I was not sure it would actually change)

Anton Tananaev 2 years ago

Those are unregistered devices. That's expected.

hypoclone 2 years ago

Alright Anton. Thank you for all you do...you are greatly appreciated

Ashok Chandra 2 years ago

There is any possibility for stop receiving data from unregistered device?

Anton Tananaev 2 years ago