From 31e05ea19c7217cdf10e6efd556bb73b0cd36ad4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9B=BE=E6=96=87=E9=94=8B0668000834?= Date: Tue, 7 Apr 2026 14:41:19 +0800 Subject: [PATCH] fix(channels): improve security warning for empty allow_from (fixes #2381) --- pkg/channels/base.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/pkg/channels/base.go b/pkg/channels/base.go index 6a1090837..f2de3699e 100644 --- a/pkg/channels/base.go +++ b/pkg/channels/base.go @@ -119,14 +119,16 @@ func NewBaseChannel( // currently defaults to accepting messages from ANYONE. To explicitly // acknowledge and permit this (e.g. for a public bot), use ["*"]. if len(bc.allowList) == 0 { - logger.WarnCF("channels", fmt.Sprintf("SECURITY: Channel '%s' allows EVERYONE (allow_from is empty)", bc.name), map[string]any{ - "channel": bc.name, - "hint": "Set allow_from to your ID, or use '*' to explicitly acknowledge open access.", + logger.WarnCF("channels", fmt.Sprintf("SECURITY: Channel '%s' allows EVERYONE (allow_from is empty). This is a potential security risk.", bc.name), map[string]any{ + "channel": bc.name, + "channelID": bc.name, + "hint": "Set allow_from to your ID, or use ['*'] to explicitly acknowledge open access. See: https://github.com/sipeed/picoclaw/blob/main/docs/configuration.md", }) } else { - logger.InfoCF("channels", fmt.Sprintf("Channel '%s' allow_from configured", bc.name), map[string]any{ + logger.InfoCF("channels", fmt.Sprintf("Channel '%s' allow_from configured (%d entries)", bc.name, len(bc.allowList)), map[string]any{ "channel": bc.name, "allow_list": bc.allowList, + "count": len(bc.allowList), }) }