234825 - duplicates.cgi reveals products user doesnt have access to

Status: RESOLVED FIXED

(Bugzilla :: Reporting/Charting, defect, P2)

Description

[Gabriel Millerd]

User-Agent:       
Build Identifier: 

the line near 272 in duplicates v1.41:

$vars->{'products'} = \@::legal_product;

... should be something akin to ...

{
    my @tmp;
    foreach my $p (@::legal_product) {
        if (CanEnterProduct($p)) {
            push(@tmp, $p);
        }
    }
    $vars->{'products'} = \@tmp;
}

Reproducible: Always
Steps to Reproduce:
visit duplicates.cgi
Actual Results:  
all products in the system

Expected Results:  
only products i have access to

Comment 1

[Gervase Markham [:gerv]]

Securing until triaged.

Gerv

Comment 2

[Gervase Markham [:gerv]]

Nominating for 2.18rc1 (shouldn't we be using flags?), because we seem to be
fixing other bugs like this at the moment.

Gerv

Comment 3

[Gervase Markham [:gerv]]

Confirming; I suspect Unconfirmed security bugs aren't on Dave's radar.

Gerv

Comment 4

[Dave Miller [:justdave]]

Gerv: since you're confirming this, I assume you've reproduced it?

Comment 5

[Joel Peshkin]

This effects the 2.16 branch as well

Comment 6

[Joel Peshkin]

Attachment: Patch for 2.16 branch

Comment 7

[Joel Peshkin]

Attachment: Patch for 2.18

Comment 8

[Dave Miller [:justdave]]

Comment on attachment 143897 [details] [diff] [review]
Patch for 2.18

>+my @selectable_products = GetSelectableProducts();
>+$vars->{'products'} = \@selectable_products;

This works, so I won't complain, but wouldn't it save an unnecessary variable
if you do it like this:

$vars->{'products'} = [ GetSelectableProducts() ];

?

Comment 9

[Dave Miller [:justdave]]

holding approval for security advisory

Comment 10

[Joel Peshkin]

Proposed wording for release notes:

Duplicates.cgi can divulge the names of products to which the user is not
supposed to have any access. 
 

Comment 11

[Joel Peshkin]

checked in on both branches

Comment 12

[Dave Miller [:justdave]]

Clearing the security flag on disclosed bugs