fukiame / meeksx Goto Github PK

• allowed state persists after app crashes / force stop (despite not using the Always allow options)
• does not check the auth state at all with a cached page from the client

the first thing is related to how upstream "remember" the clients: a sqlite table on storage
as they doesnt clear the temporary table after server stops, only after server stops
planning to yeet that entirely and uses one that stores a list in memory

the second crap is just straight up an exploit bro the auth system is essentially nullified bruh bruh bruh hruh vruh
that lived through to, what version is it, 2.3.6 already? how did upstream not notice this...