bugSamizdat - Bugs: bug #20134, arbitrary editing of any(?)...

 
 

bug #20134: arbitrary editing of any(?) article, wikified or non-wikified, under false (e.g. previous) author id

Submitted by:  Boud Roukema <boud>
Submitted on:  Sat 09 Jun 2007 09:04:42 PM UTC  
 
Category: NoneSeverity: 6 - Security
Status: FixedPrivacy: Public
Assigned to: NoneOpen/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 09 Jun 2007 09:32:23 PM UTC, comment #2:

PROPOSED PATCH:

--- /usr/lib/ruby/1.8/samizdat/controllers/message_controller.rb~ 2007-05-23 01:48:50.000000000 +0200
+++ /usr/lib/ruby/1.8/samizdat/controllers/message_controller.rb 2007-06-09 23:24:31.315053344 +0200
@@ -151,7 +151,8 @@
assert_post

@message = Message.cached(@id)
- if @message.creator.id != @session.member and not @message.open
+ if @session.member == nil or
+ ( @message.creator.id != @session.member and not @message.open )
raise UserError, _('You are not allowed to edit this message')
end
@message.assert_current_version

COMMENT:
This patch is pretty easy and seems obvious and seems sufficient to me, but a second opinion would be good... Hopefully there are not too many other similar bugs lying around....

Boud Roukema <boud>
Project Member
Sat 09 Jun 2007 09:12:45 PM UTC, comment #1:

LOGGED-IN-USER VS GUEST:

It seems that a logged in user is (correctly) refused access via this method, while an anonymous user is (incorrectly) accepted. :P

Boud Roukema <boud>
Project Member
Sat 09 Jun 2007 09:04:42 PM UTC, original submission:

METHOD:

<sitebaseURL>/message/<message_number>/edit

EXPERIMENTS SO FAR:

It seems that non-wikified articles can be edited this way. The edits are usually credited to the previous user, or else to "guest". (i have only tried this while being not logged in.)

VERSIONS:

  • 070519 + boud's patches
  • version on belarus.indymedia.org

EXAMPLE:
http://belarus.indymedia.org/history/10010

> 07.06, Germania, video s goloj akcii
> by guest on 2007-06-09 20:39


The above edit (inserting a space chaing "VLC!!!" into "VLC !!!") was made as an anonymous user by going to

http://belarus.indymedia.org/message/10010/edit

without logging in.

On my home installation, this method definitely works on non-wiki articles.

On another website, with essentially 070519 + my patches, an open-for-editing article previously edited by a user with a login, was edited as an anonymous user and got credited to guest instead of the previous user.

DISCUSSION:

This bug requires the user to understand the concept of editing a URL, which is a barrier to most ordinary users in e.g. Poland in mid 2007, but it is nevertheless a serious bug! There is probably an easy solution, but i'm reporting it now without any proposed fixes because it's clearly important. It could also be used to discredit the software if it were made widely known...

i assume it's related to the MVC restructuring.

It could be related to bug #19912 - https://savannah.nongnu.org/bugs/?19912

Boud Roukema <boud>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by angdraug (Updated the item)
  • -unavailable- added by boud (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 15 Jul 2007 11:02:41 PM UTCboudStatusIn Progress=>Fixed
      PrivacyPrivate=>Public
      Open/ClosedOpen=>Closed
    Sat 16 Jun 2007 11:13:06 AM UTCangdraugStatusNone=>In Progress

    Back to the top


    Powered by Savane 3.1-cleanup1