bugSamizdat - Bugs: bug #19912, BUG: how to edit a wikified...

 
 

bug #19912: BUG: how to edit a wikified article under another user's identity (guest or member)

Submitted by:  Boud Roukema <boud>
Submitted on:  Sun 20 May 2007 01:08:34 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Status: FixedPrivacy: Public
Assigned to: NoneOpen/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 20 May 2007 01:41:12 PM UTC, comment #1:

i'm downgrading this to normal since Dmitry's fix to 19909 solves the most important aspect of this bug.

Dmitry gave this fix to bug 19909: https://savannah.nongnu.org/bugs/index.php?19909

> The fix is simple and obvious:


--- lib/samizdat/controllers/message_controller.rb
3e4f5ea3e7a6cb63ce0b2b8929f0825023d1b978
+++ lib/samizdat/controllers/message_controller.rb
0f2485144a2a0fbc72fef7603c89b43cf1d2503f
@@ -156,6 +156,7 @@ class MessageController < Controller
end
@message.assert_current_version

+ set_creator
set_content
set_lang(@message.lang)
set_desc

This removes the security problem (faking identity) according to my tests.

There still remains an annoyance level bug (compared with, e.g. mediawiki):

8. result: confirm is accepted without error, but user's modifications
to 3105 are ignored and there is no history link on 3105.

In mediawiki there is no problem doing parallel edits in different panels.

Independently of mediawiki, ignoring a user's contribution is in general not a Good Thing.

i suspect this might be partly related to avoiding cross-scipting attacks.

In any case, for me it's still a bug, though probably not of high priority.

Boud Roukema <boud>
Project Member
Sun 20 May 2007 01:08:34 PM UTC, original submission:

SUMMARY:
By editing two articles in parallel in two different panels in a certain way, a user can edit as many wikified articles as s/he wishes under the identities of those other users (either guest or member).

COMMENT:
For obvious reasons, this could make people REALLY upset with samizdat. Since we have no guarantee that people will update properly (quickly) after the bug is fixed, i'm setting this as private in savannah.

VERSION:
0.6.0.20070609-1

DESCRIPTION
1. guest publishes message 3105 open for editing

2. guest publishes message 3106 open for editing

3. user logs in

4. in browser panel A, user starts editing 3105, hits preview (does
not yet hit confirm)

5. in browser panel B, user edits 3106, previews, confirms

6. result: 3106 has been successfully edited, but the author of the
modified version is guest, not user

7. in panel A, user confirms.

8. result: confirm is accepted without error, but user's modifications
to 3105 are ignored and there is no history link on 3105.

9. user can now repeatedly edit article 3105 in panel A and article 3106
in panel B. all the edits are recorded as author=guest

10. user chooses another openly editable article written by user_2
from the frontpage (previously loaded in panel Z), successfully
edits, previews, confirms. The history credits the change
to user_2, not to user.

11. user is now authorised to have an incredible amount of fun under other people's electronic identities and sabotage the whole informal web of trust that exists between users.

Boud Roukema <boud>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by boud (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 15 Jul 2007 11:02:10 PM UTCboudStatusNone=>Fixed
      PrivacyPrivate=>Public
      Open/ClosedOpen=>Closed
    Sun 20 May 2007 01:41:12 PM UTCboudSeverity6 - Security=>3 - Normal

    Back to the top


    Powered by Savane 3.1-cleanup1