From c095387b13173663325a1ba65139c8e818e4e283 Mon Sep 17 00:00:00 2001
From: Kyle Spier-Swenson <kyleshome@gmail.com>
Date: Wed, 17 May 2023 12:05:46 -0700
Subject: [PATCH 1/3] Fix exploit allowing for the reading of discord
 connection strings.

enabling view json in the web panel was the correct call.
---
 src/Tgstation.Server.Host/Controllers/ChatController.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Tgstation.Server.Host/Controllers/ChatController.cs b/src/Tgstation.Server.Host/Controllers/ChatController.cs
index b71f9817ae..d6a33f6fe8 100644
--- a/src/Tgstation.Server.Host/Controllers/ChatController.cs
+++ b/src/Tgstation.Server.Host/Controllers/ChatController.cs
@@ -220,7 +220,7 @@ namespace Tgstation.Server.Host.Controllers
 							.OrderBy(x => x.Id))),
 				chatBot =>
 				{
-					if (connectionStrings)
+					if (!connectionStrings)
 						chatBot.ConnectionString = null;
 
 					return Task.CompletedTask;

From 47c44b1a58b2618e8cd9f0f14f67a609a8bc5834 Mon Sep 17 00:00:00 2001
From: Dominion <Cyberboss@users.noreply.github.com>
Date: Wed, 17 May 2023 19:06:21 -0400
Subject: [PATCH 2/3] Add regression test for chat bot connection string
 viewing

---
 .../Live/Instance/ChatTest.cs                 | 40 +++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/tests/Tgstation.Server.Tests/Live/Instance/ChatTest.cs b/tests/Tgstation.Server.Tests/Live/Instance/ChatTest.cs
index ee1b718d96..ab8553fc22 100644
--- a/tests/Tgstation.Server.Tests/Live/Instance/ChatTest.cs
+++ b/tests/Tgstation.Server.Tests/Live/Instance/ChatTest.cs
@@ -7,6 +7,7 @@ using Microsoft.VisualStudio.TestTools.UnitTesting;
 
 using Tgstation.Server.Api.Models;
 using Tgstation.Server.Api.Models.Request;
+using Tgstation.Server.Api.Rights;
 using Tgstation.Server.Client;
 using Tgstation.Server.Client.Components;
 
@@ -30,7 +31,11 @@ namespace Tgstation.Server.Tests.Live.Instance
 			var ircTask = RunIrc(cancellationToken);
 			await RunDiscord(cancellationToken);
 			await ircTask;
+
+			var listTest = RunListTest(cancellationToken);
 			await RunLimitTests(cancellationToken);
+
+			await listTest;
 		}
 
 		async Task RunIrc(CancellationToken cancellationToken)
@@ -190,6 +195,41 @@ namespace Tgstation.Server.Tests.Live.Instance
 			Assert.AreEqual(0, nowBots.Count);
 		}
 
+		async Task RunListTest(CancellationToken cancellationToken)
+		{
+			// regression test for GHSA-rv76-495p-g7cp
+			// test starts with all perms
+			var permsClient = instanceClient.CreateClient(metadata).PermissionSets;
+			var ourInstancePermissionSetTask = permsClient.Read(cancellationToken);
+
+			var ourIPS = await ourInstancePermissionSetTask;
+			Assert.IsTrue(ourIPS.ChatBotRights.Value.HasFlag(ChatBotRights.ReadConnectionString));
+
+			var results = await chatClient.List(null, cancellationToken);
+
+			Assert.IsTrue(results.Count > 0);
+			Assert.IsTrue(results.All(chatBot => chatBot.ConnectionString != null));
+
+			var result = await chatClient.GetId(results[0], cancellationToken);
+
+			Assert.IsNotNull(result.ConnectionString);
+
+			await permsClient.Update(new InstancePermissionSetRequest
+			{
+				PermissionSetId = ourIPS.PermissionSetId,
+				ChatBotRights = ourIPS.ChatBotRights.Value & (~ChatBotRights.ReadConnectionString),
+			}, cancellationToken);
+
+			results = await chatClient.List(null, cancellationToken);
+
+			Assert.IsTrue(results.Count > 0);
+			Assert.IsTrue(results.All(chatBot => chatBot.ConnectionString == null));
+
+			result = await chatClient.GetId(results[0], cancellationToken);
+
+			Assert.IsNull(result.ConnectionString);
+		}
+
 		async Task RunLimitTests(CancellationToken cancellationToken)
 		{
 			await ApiAssert.ThrowsException<ConflictException>(() => chatClient.Create(new ChatBotCreateRequest

From 3c9f42682323ccb3c99b69d49f7c3d1c387be533 Mon Sep 17 00:00:00 2001
From: Dominion <Cyberboss@users.noreply.github.com>
Date: Wed, 17 May 2023 19:07:02 -0400
Subject: [PATCH 3/3] Version bump to 5.12.1

---
 build/Version.props | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build/Version.props b/build/Version.props
index 2f853ecd6c..b504f97e2e 100644
--- a/build/Version.props
+++ b/build/Version.props
@@ -3,7 +3,7 @@
   <!-- Integration tests will ensure they match across the board -->
   <Import Project="ControlPanelVersion.props" />
   <PropertyGroup>
-    <TgsCoreVersion>5.12.0</TgsCoreVersion>
+    <TgsCoreVersion>5.12.1</TgsCoreVersion>
     <TgsConfigVersion>4.6.0</TgsConfigVersion>
     <TgsApiVersion>9.10.2</TgsApiVersion>
     <TgsApiLibraryVersion>10.4.1</TgsApiLibraryVersion>