Skip to content

Commit

Permalink
Avoid people to alter other projects by changing form data
Browse files Browse the repository at this point in the history
  • Loading branch information
@fguillot
fguillot committed Sep 24, 2017
1 parent 8ecaa60 commit 074f6c1
Show file tree
Hide file tree
Showing 26 changed files with 154 additions and 111 deletions.
4 changes: 4 additions & 0 deletions ChangeLog
View file
Expand Up @@ -5,6 +5,10 @@ New features:

* Vietnamese translation

Security Issues:

* Avoid people to alter other project resources by changing form data

Version 1.0.46 (August 13, 2017)
--------------------------------

Expand Down
5 changes: 3 additions & 2 deletions app/Controller/ActionController.php
View file
Expand Up @@ -46,9 +46,10 @@ public function index()
public function confirm()
{
$project = $this->getProject();
$action = $this->getAction($project);

$this->response->html($this->helper->layout->project('action/remove', array(
'action' => $this->actionModel->getById($this->request->getIntegerParam('action_id')),
'action' => $action,
'available_events' => $this->eventManager->getAll(),
'available_actions' => $this->actionManager->getAvailableActions(),
'project' => $project,
Expand All @@ -65,7 +66,7 @@ public function remove()
{
$this->checkCSRFParam();
$project = $this->getProject();
$action = $this->actionModel->getById($this->request->getIntegerParam('action_id'));
$action = $this->getAction($project);

if (! empty($action) && $this->actionModel->remove($action['id'])) {
$this->flash->success(t('Action removed successfully.'));
Expand Down
7 changes: 5 additions & 2 deletions app/Controller/ActionCreationController.php
View file
Expand Up @@ -35,8 +35,9 @@ public function event()
{
$project = $this->getProject();
$values = $this->request->getValues();
$values['project_id'] = $project['id'];

if (empty($values['action_name']) || empty($values['project_id'])) {
if (empty($values['action_name'])) {
return $this->create();
}

Expand All @@ -57,8 +58,9 @@ public function params()
{
$project = $this->getProject();
$values = $this->request->getValues();
$values['project_id'] = $project['id'];

if (empty($values['action_name']) || empty($values['project_id']) || empty($values['event_name'])) {
if (empty($values['action_name']) || empty($values['event_name'])) {
$this->create();
return;
}
Expand Down Expand Up @@ -109,6 +111,7 @@ public function save()
*/
private function doCreation(array $project, array $values)
{
$values['project_id'] = $project['id'];
list($valid, ) = $this->actionValidator->validateCreation($values);

if ($valid) {
Expand Down
90 changes: 90 additions & 0 deletions app/Controller/BaseController.php
View file
Expand Up @@ -155,4 +155,94 @@ protected function getSubtask()

return $subtask;
}

protected function getColumn(array $project)
{
$column = $this->columnModel->getById($this->request->getIntegerParam('column_id'));

if (empty($column)) {
throw new PageNotFoundException();
}

if ($column['project_id'] != $project['id']) {
throw new AccessForbiddenException();
}

return $column;
}

protected function getSwimlane(array $project)
{
$swimlane = $this->swimlaneModel->getById($this->request->getIntegerParam('swimlane_id'));

if (empty($swimlane)) {
throw new PageNotFoundException();
}

if ($swimlane['project_id'] != $project['id']) {
throw new AccessForbiddenException();
}

return $swimlane;
}

protected function getCategory(array $project)
{
$category = $this->categoryModel->getById($this->request->getIntegerParam('category_id'));

if (empty($category)) {
throw new PageNotFoundException();
}

if ($category['project_id'] != $project['id']) {
throw new AccessForbiddenException();
}

return $category;
}

protected function getProjectTag(array $project)
{
$tag = $this->tagModel->getById($this->request->getIntegerParam('tag_id'));

if (empty($tag)) {
throw new PageNotFoundException();
}

if ($tag['project_id'] != $project['id']) {
throw new AccessForbiddenException();
}

return $tag;
}

protected function getAction(array $project)
{
$action = $this->actionModel->getById($this->request->getIntegerParam('action_id'));

if (empty($action)) {
throw new PageNotFoundException();
}

if ($action['project_id'] != $project['id']) {
throw new AccessForbiddenException();
}

return $action;
}

protected function getCustomFilter(array $project)
{
$filter = $this->customFilterModel->getById($this->request->getIntegerParam('filter_id'));

if (empty($filter)) {
throw new PageNotFoundException();
}

if ($filter['project_id'] != $project['id']) {
throw new AccessForbiddenException();
}

return $filter;
}
}
31 changes: 9 additions & 22 deletions app/Controller/CategoryController.php
View file
Expand Up @@ -12,24 +12,6 @@
*/
class CategoryController extends BaseController
{
/**
* Get the category (common method between actions)
*
* @access private
* @return array
* @throws PageNotFoundException
*/
private function getCategory()
{
$category = $this->categoryModel->getById($this->request->getIntegerParam('category_id'));

if (empty($category)) {
throw new PageNotFoundException();
}

return $category;
}

/**
* List of categories for a given project
*
Expand Down Expand Up @@ -72,8 +54,9 @@ public function create(array $values = array(), array $errors = array())
public function save()
{
$project = $this->getProject();

$values = $this->request->getValues();
$values['project_id'] = $project['id'];

list($valid, $errors) = $this->categoryValidator->validateCreation($values);

if ($valid) {
Expand All @@ -100,7 +83,7 @@ public function save()
public function edit(array $values = array(), array $errors = array())
{
$project = $this->getProject();
$category = $this->getCategory();
$category = $this->getCategory($project);

$this->response->html($this->template->render('category/edit', array(
'values' => empty($values) ? $category : $values,
Expand All @@ -117,8 +100,12 @@ public function edit(array $values = array(), array $errors = array())
public function update()
{
$project = $this->getProject();
$category = $this->getCategory($project);

$values = $this->request->getValues();
$values['project_id'] = $project['id'];
$values['id'] = $category['id'];

list($valid, $errors) = $this->categoryValidator->validateModification($values);

if ($valid) {
Expand All @@ -141,7 +128,7 @@ public function update()
public function confirm()
{
$project = $this->getProject();
$category = $this->getCategory();
$category = $this->getCategory($project);

$this->response->html($this->helper->layout->project('category/remove', array(
'project' => $project,
Expand All @@ -158,7 +145,7 @@ public function remove()
{
$this->checkCSRFParam();
$project = $this->getProject();
$category = $this->getCategory();
$category = $this->getCategory($project);

if ($this->categoryModel->remove($category['id'])) {
$this->flash->success(t('Category removed successfully.'));
Expand Down
16 changes: 11 additions & 5 deletions app/Controller/ColumnController.php
View file
Expand Up @@ -61,6 +61,7 @@ public function save()
{
$project = $this->getProject();
$values = $this->request->getValues() + array('hide_in_dashboard' => 0);
$values['project_id'] = $project['id'];

list($valid, $errors) = $this->columnValidator->validateCreation($values);

Expand Down Expand Up @@ -95,7 +96,7 @@ public function save()
public function edit(array $values = array(), array $errors = array())
{
$project = $this->getProject();
$column = $this->columnModel->getById($this->request->getIntegerParam('column_id'));
$column = $this->getColumn($project);

$this->response->html($this->helper->layout->project('column/edit', array(
'errors' => $errors,
Expand All @@ -113,7 +114,11 @@ public function edit(array $values = array(), array $errors = array())
public function update()
{
$project = $this->getProject();
$column = $this->getColumn($project);

$values = $this->request->getValues() + array('hide_in_dashboard' => 0);
$values['project_id'] = $project['id'];
$values['id'] = $column['id'];

list($valid, $errors) = $this->columnValidator->validateModification($values);

Expand Down Expand Up @@ -164,9 +169,10 @@ public function move()
public function confirm()
{
$project = $this->getProject();
$column = $this->getColumn($project);

$this->response->html($this->helper->layout->project('column/remove', array(
'column' => $this->columnModel->getById($this->request->getIntegerParam('column_id')),
'column' => $column,
'project' => $project,
)));
}
Expand All @@ -178,11 +184,11 @@ public function confirm()
*/
public function remove()
{
$project = $this->getProject();
$this->checkCSRFParam();
$column_id = $this->request->getIntegerParam('column_id');
$project = $this->getProject();
$column = $this->getColumn($project);

if ($this->columnModel->remove($column_id)) {
if ($this->columnModel->remove($column['id'])) {
$this->flash->success(t('Column removed successfully.'));
} else {
$this->flash->failure(t('Unable to remove this column.'));
Expand Down
7 changes: 5 additions & 2 deletions app/Controller/CustomFilterController.php
View file
Expand Up @@ -59,6 +59,7 @@ public function save()
$project = $this->getProject();

$values = $this->request->getValues();
$values['project_id'] = $project['id'];
$values['user_id'] = $this->userSession->getId();

list($valid, $errors) = $this->customFilterValidator->validateCreation($values);
Expand All @@ -84,7 +85,7 @@ public function save()
public function confirm()
{
$project = $this->getProject();
$filter = $this->customFilterModel->getById($this->request->getIntegerParam('filter_id'));
$filter = $this->getCustomFilter($project);

$this->response->html($this->helper->layout->project('custom_filter/remove', array(
'project' => $project,
Expand All @@ -102,7 +103,7 @@ public function remove()
{
$this->checkCSRFParam();
$project = $this->getProject();
$filter = $this->customFilterModel->getById($this->request->getIntegerParam('filter_id'));
$filter = $this->getCustomFilter($project);

$this->checkPermission($project, $filter);

Expand Down Expand Up @@ -153,6 +154,8 @@ public function update()
$this->checkPermission($project, $filter);

$values = $this->request->getValues();
$values['id'] = $filter['id'];
$values['project_id'] = $project['id'];

if (! isset($values['is_shared'])) {
$values += array('is_shared' => 0);
Expand Down
2 changes: 2 additions & 0 deletions app/Controller/ProjectEditController.php
View file
Expand Up @@ -65,6 +65,8 @@ public function update()
*/
private function prepareValues(array $project, array $values)
{
$values['id'] = $project['id'];

if (isset($values['is_private'])) {
if (! $this->helper->user->hasProjectAccess('ProjectCreationController', 'create', $project['id'])) {
unset($values['is_private']);
Expand Down

0 comments on commit 074f6c1

Please sign in to comment.