308662 - [SECURITY] User matching bypasses 'usevisibilitygroups' restrictions

Status: RESOLVED FIXED

(Bugzilla :: User Accounts, defect)

Description

[Frédéric Buclin]

When using substrings in User::match(), i.e. when user matching is in use with
the "search" mode activated, I am able to access user accounts I am not allowed
to see, despite 'usevisibilitygroups' is turned on. The "wildcards" mode seems
to work as expected, i.e. really restricts its search to user accounts I am
allowed to see.

Comment 1

[Max Kanat-Alexander]

I'd actually rather move this particular sec bug to 2.20.1, as we will have
other known issues with usevisibilitygroups in 2.20, and I don't want to put off
2.20 forever.

Comment 2

[Joel Peshkin]

Attachment: Fix the query

Comment 3

[Frédéric Buclin]

Comment on attachment 196168 [details] [diff] [review]
Fix the query

r=LpSolit for both the tip and 2.20.

Comment 4

[Max Kanat-Alexander]

This is a small enough change that it can block 2.20.

Comment 5

[Frédéric Buclin]

tip:

Checking in Bugzilla/User.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/User.pm,v  <--  User.pm
new revision: 1.86; previous revision: 1.85
done

2.20:

Checking in Bugzilla/User.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/User.pm,v  <--  User.pm
new revision: 1.61.2.10; previous revision: 1.61.2.9
done

Comment 6

[Max Kanat-Alexander]

OK, security advisory sent, removing this bug from the security group.

Comment 7

[Juha-Matti Laurio]

This was assigned to very new http://www.securityfocus.com/bid/14996 entitled as
"Bugzilla User-Matching Information Disclosure Vulnerability" now.