Closed
Bug 621110
Opened 14 years ago
Closed 14 years ago
[SECURITY] Quips (adding/approving/deleting) lacks CSRF protection
Categories
(Bugzilla :: Bugzilla-General, defect)
Tracking
()
RESOLVED
FIXED
Bugzilla 3.2
People
(Reporter: reed, Assigned: LpSolit)
References
Details
(Whiteboard: [infrasec:csrf][ws:moderate])
Attachments
(2 files)
|
3.25 KB,
patch
|
dkl
:
review+
|
Details | Diff | Splinter Review |
|
3.26 KB,
patch
|
dkl
:
review+
|
Details | Diff | Splinter Review |
quips.cgi has no CSRF protection.
|
Assignee | |
Comment 1•14 years ago
|
||
Quips are really an unimportant bit of Bugzilla. You cannot do any harm.
Severity: normal → minor
|
Reporter | |
Comment 2•14 years ago
|
||
Sure you can. You can add/approve/delete quips.
|
|
Assignee | |
Comment 3•14 years ago
|
||
Yes, exactly what I said: you cannot do any harm. Quips are unimportant and have no interaction with other bits of the Bugzilla code.
|
|
Reporter | |
Comment 4•14 years ago
|
||
I disagree with your assertion that you "cannot do any harm", and I think more than a few Bugzilla administrators would likewise disagree. Having the entire quips database deleted would definitely be harmful to Bugzilla users who actually use quips. Just because you don't use it doesn't mean it's not important to somebody else.
|
|
Assignee | |
Updated•14 years ago
|
Assignee: general → LpSolit
|
|
Assignee | |
Comment 5•14 years ago
|
||
Attachment #499887 -
Flags: review?(mkanat)
|
|
Reporter | |
Comment 6•14 years ago
|
||
Why hash tokens over session tokens here?
|
|
Assignee | |
Comment 7•14 years ago
|
||
(In reply to comment #6)
> Why hash tokens over session tokens here?
Because I'm not going to fill the DB with tokens when editing quips.
|
|
Assignee | |
Updated•14 years ago
|
Attachment #499887 -
Flags: review?(mkanat) → review?(dkl)
|
|
Reporter | |
Updated•14 years ago
|
Flags: blocking4.0?
Flags: blocking3.6.4?
Flags: blocking3.4.10?
Flags: blocking3.2.10?
|
||
Comment 8•14 years ago
|
||
Comment on attachment 499887 [details] [diff] [review]
patch for 4.1, v1
Looks good and works as expected. r=dkl
Attachment #499887 -
Flags: review?(dkl) → review+
|
|
||
Updated•14 years ago
|
Flags: approval?
Flags: approval4.0?
|
|
Assignee | |
Comment 9•14 years ago
|
||
Due to bug 398701 which landed on trunk only, I need to backport this patch on branches. A trivial change.
Status: NEW → ASSIGNED
Flags: blocking4.0?
Flags: blocking4.0+
Flags: blocking3.6.4?
Flags: blocking3.6.4+
Flags: blocking3.4.10?
Flags: blocking3.4.10+
Flags: blocking3.2.10?
Flags: blocking3.2.10+
Flags: approval4.0?
|
|
Assignee | |
Comment 10•14 years ago
|
||
replace FILTER uri by FILTER url_quote. This patch works on all branches, from 3.2 to 4.0.
Attachment #506126 -
Flags: review?(dkl)
|
|
||
Comment 11•14 years ago
|
||
Comment on attachment 506126 [details] [diff] [review]
patch for 3.2 - 4.0, v1
Looks good and works as expected. r=dkl
Attachment #506126 -
Flags: review?(dkl) → review+
|
|
||
Updated•14 years ago
|
Flags: approval4.0?
Flags: approval3.6?
|
|
Assignee | |
Updated•14 years ago
|
Flags: approval3.4?
Flags: approval3.2?
|
|
Assignee | |
Updated•14 years ago
|
Attachment #499887 -
Attachment description: patch, v1 → patch for 4.1, v1
|
|
Assignee | |
Updated•14 years ago
|
Flags: approval?
Flags: approval4.0?
Flags: approval4.0+
Flags: approval3.6?
Flags: approval3.6+
Flags: approval3.4?
Flags: approval3.4+
Flags: approval3.2?
Flags: approval3.2+
Flags: approval+
|
|
Assignee | |
Comment 13•14 years ago
|
||
Committing to: bzr+ssh://lpsolit%40gmail.com@bzr.mozilla.org/bugzilla/trunk/
modified quips.cgi
modified template/en/default/list/quips.html.tmpl
Committed revision 7670.
Committing to: bzr+ssh://lpsolit%40gmail.com@bzr.mozilla.org/bugzilla/4.0/
modified quips.cgi
modified template/en/default/list/quips.html.tmpl
Committed revision 7527.
Committing to: bzr+ssh://lpsolit%40gmail.com@bzr.mozilla.org/bugzilla/3.6/
modified quips.cgi
modified template/en/default/list/quips.html.tmpl
Committed revision 7222.
Committing to: bzr+ssh://lpsolit%40gmail.com@bzr.mozilla.org/bugzilla/3.4/
modified quips.cgi
modified template/en/default/list/quips.html.tmpl
Committed revision 6789.
Committing to: bzr+ssh://lpsolit%40gmail.com@bzr.mozilla.org/bugzilla/3.2/
modified quips.cgi
modified template/en/default/list/quips.html.tmpl
Committed revision 6410.
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
|
|
Assignee | |
Comment 14•14 years ago
|
||
Security advisory sent. Removing the security flag.
Group: bugzilla-security
|
||
Comment 15•14 years ago
|
||
Hard to imagine anything to do with quips rating ws:high
Whiteboard: [infrasec:csrf][ws:high] → [infrasec:csrf][ws:moderate]
You need to log in
before you can comment on or make changes to this bug.
Description
•