mirror of
https://github.com/rclone/rclone.git
synced 2026-10-10 06:55:45 -04:00
Nick Craig-Wood
939f82d908
job/status returns the complete output of the job so it is as sensitive as the call which started the job, e.g. config/dump started with _async returns the config file including any secrets. It was possible to read this without authentication where an authenticated and an unauthenticated rc server share the same process, e.g. rclone gui --rc. An unauthenticated client can't start jobs on a server which needs authentication, other than with the calls which don't need it, so this shouldn't affect existing users.