Actions
Bug #9512
closed
Privilege bypass due to match style used by widget privileges
Start date:
05/09/2019
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
All
Affected Architecture:
All
Description
The current dashboard and widget privileges specify a leading wildcard, for example:
$priv_list['page-dashboard-all']['match'][] = "*.widget.php*";
$priv_list['page-dashboard-widgets']['match'][] = "*.widget.php*";
Due to this loose matching, adding ?&.widget.php" to any URL will allow the user to bypass privileges set on the page when making a GET or POST request.
Updated by Jim Pingle over 5 years ago
Changing the match to start with the path to the widgets works around the problem:
$priv_list['page-dashboard-all']['match'][] = "widgets/widgets/*.widget.php*";
$priv_list['page-dashboard-widgets']['match'][] = "widgets/widgets/*.widget.php*";
Updated by Jim Pingle over 5 years ago
- Status changed from New to Feedback
- % Done changed from 0 to 100
Applied in changeset bc319bc01a4d709b39e4c93c7223d277ee666bff.
Updated by Jim Pingle over 5 years ago
- Target version changed from 2.5.0 to 2.4.4-p3
Updated by Chris Linstruth over 5 years ago
Confirmed user could access any page by appending ?&.widget.php to the URL in 2.4.4-p2. 2.4.4-p3 only allowed access to the permitted page(s) using the same technique.
Actions