GHSA-gpgp-w4x2-h3h7

## Summary The endpoint `plugin/Live/view/Live_restreams/list.json.php` contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user with streaming permission to retrieve other users' live restream configurations, including third-party platform stream keys and OAuth tokens (access_token, refresh_token) for services like YouTube Live, Facebook Live, and Twitch. ## Details The authorization logic in `list.json.php` is intended to restrict non-admin users to viewing only their own restream records. However, the implementation at lines 10-14 only enforces this when the `users_id` GET parameter is absent: ```php // plugin/Live/view/Live_restreams/list.json.php:6-19 if (!User::canStream()) { die('{"data": []}'); } if (empty($_GET['users_id'])) { // Line 10: only triggers when param is MISSING if (!User::isAdmin()) { $_GET['users_id'] = User::getId(); // Line 12: force to own ID } } if (empty($_GET['users_id'])) { $rows = Live_restreams::getAll(); } else { $rows = Live_restreams::getAllFromUser($_GET['users_id'], ""); // Line 19: attacker-controlled ID } ``` When a non-admin user explicitly supplies `?users_id=<victim_id>`, the value is non-empty, so the override at line 12 is never reached. The attacker-controlled ID passes directly to `getAllFromUser()`, which executes: ```php // plugin/Live/Objects/Live_restreams.php:90 $sql = "SELECT * FROM live_restreams WHERE users_id = $users_id"; ``` This returns all columns from the `live_restreams` table, including: - `stream_key` (VARCHAR 500) — the victim's RTMP stream key for third-party platforms - `stream_url` (VARCHAR 500) — the RTMP ingest endpoint - `parameters` (TEXT) — JSON blob containing OAuth credentials (`access_token`, `refresh_token`, `expires_at`) obtained via the restream.ypt.me OAuth flow Other endpoints in the same directory correctly validate ownership. For example, `delete.json.php:19`: ```php if (!User::isAdmin() && $row->