external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix account editing and hijacking vulnerability

Browse source 
Checks are in place to avoid users getting account editing forms
they shouldn't have access to. The appropriate checks before
editing the account in the backend are not in place.

This vulnerability allows a user to craft malicious POST data to
edit other user accounts, thereby allowing account hijacking.

Add a new flexible function can_edit_account() to determine if
a user has appropriate permissions. Run the permission check before
processing any account information in the backend.

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
This commit is contained in:
canyonknight 2012-11-29 16:54:29 -05:00 • committed by Lukas Fleischer
parent e383205eda
commit 87fe4701cd
2 changed files with 37 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
web/html/account.php
View file

@ -73,9 +73,14 @@ if (isset($_COOKIE["AURSID"])) {
}
} elseif ($action == "UpdateAccount") {
# user is submitting their modifications to an existing account
#
if (check_token()) {
$uid = uid_from_sid($_COOKIE['AURSID']);
/* Details for account being updated */
$acctinfo = account_details(in_request('ID'), in_request('U'));
/* Verify user permissions and that the request is a valid POST */
if (can_edit_account($atype, $acctinfo, $uid) && check_token()) {
/* Update the details for the existing account */
process_account_form($atype, "edit", "UpdateAccount",
in_request("U"), in_request("T"), in_request("S"),
in_request("E"), in_request("P"), in_request("C"),

29
web/lib/acctfuncs.inc.php
View file

@ -1015,3 +1015,32 @@ function cast_proposal_vote($voteid, $uid, $vote, $newtotal, $dbh=NULL) {
$q = "INSERT INTO TU_Votes (VoteID, UserID) VALUES (" . intval($voteid) . ", " . intval($uid) . ")";
$result = $dbh->exec($q);
}
/**
* Verify a user has the proper permissions to edit an account
*
* @param string $atype Account type of the editing user
* @param array $acctinfo User account information for edited account
* @param int $uid User ID of the editing user
*
* @return bool True if permission to edit the account, otherwise false
*/
function can_edit_account($atype, $acctinfo, $uid) {
/* Developers can edit any account */
if ($atype == 'Developer') {
return true;
}
/* Trusted Users can edit all accounts except Developer accounts */
if ($atype == 'Trusted User' &&
$acctinfo['AccountType'] != 'Developer') {
return true;
}
/* Users can edit only their own account */
if ($acctinfo['ID'] == $uid) {
return true;
}
return false;
}