346564 - [SECURITY] timetracking deadline leaks in XML

Status: VERIFIED FIXED

(Bugzilla :: Bug Import/Export & Moving, defect)

Description

[timeless]

Comment 1

[Frédéric Buclin]

The reason is that Bug.pm shows these fields by default:

    if (Param('timetrackinggroup')) {
        push @fields, qw(estimated_time remaining_time actual_time deadline);
    }


But show_bug.cgi incorrectly excludes them when the user is not in the timetracking group:

unless (UserInGroup(Param("timetrackinggroup"))) {
    @fieldlist = grep($_ !~ /_time$/, @fieldlist);
}

The first 3 fields are excluded, but deadline doesn't match the regexp.

Comment 2

[Frédéric Buclin]

The fix is not too hard and would prevent confidential data from being displayed. Requesting blocking.

Comment 3

[Olav Vitters]

Deadline is new to Bugzilla 2.20, see bug 103636. Fixing this for 2.18 would be hard ;)

Cancelling blocking2.18.6.

Comment 4

[Frédéric Buclin]

As bkor is working on it, there is a good chance to have it ready for our next set of releases.

Comment 5

[Olav Vitters]

Attachment: Patch v1

Found no other unfiled code that leaked the timetracking fields (in any of the Bugzilla versions). Did wonder a bit about percentage_complete and show_bug.cgi, but that field seems to be buglist.cgi only.

Comment 6

[Frédéric Buclin]

Comment on attachment 237541 [details] [diff] [review]
Patch v1

r=LpSolit

Comment 7

[Olav Vitters]

Attachment: Backport for 2.20 and 2.22

Comment 8

[Frédéric Buclin]

Comment on attachment 237613 [details] [diff] [review]
Backport for 2.20 and 2.22

r=LpSolit

Comment 9

[Max Kanat-Alexander]

Deadline was first introduced in 2.19.2, so that's when this bug dates back to.

Comment 10

[Frédéric Buclin]

tip:

Checking in show_bug.cgi;
/cvsroot/mozilla/webtools/bugzilla/show_bug.cgi,v  <--  show_bug.cgi
new revision: 1.49; previous revision: 1.48
done


2.22:

Checking in show_bug.cgi;
/cvsroot/mozilla/webtools/bugzilla/show_bug.cgi,v  <--  show_bug.cgi
new revision: 1.38.2.1; previous revision: 1.38
done


2.20:

Checking in show_bug.cgi;
/cvsroot/mozilla/webtools/bugzilla/show_bug.cgi,v  <--  show_bug.cgi
new revision: 1.32.4.2; previous revision: 1.32.4.1
done

Comment 11

[Max Kanat-Alexander]

Security Advisory has been sent, so this bug is no longer private.