Skip to content

security: add missing authorization checks to AJAX endpoints and module actions #724

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anonymoususer72041 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

security: add missing authorization checks to AJAX endpoints and module actions #724

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions ajax/deleteActivity.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,12 @@
die();
}

if ($_SESSION['CATS']->getAccessLevel('contacts.deleteActivity') < ACCESS_LEVEL_EDIT)
{
$interface->outputXMLErrorPage(-1, ERROR_NO_PERMISSION);
die();
}

if (!$interface->isRequiredIDValid('activityID'))
{
$interface->outputXMLErrorPage(-1, 'Invalid activity ID.');
Expand Down
6 changes: 6 additions & 0 deletions ajax/editActivity.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,12 @@
die();
}

if ($_SESSION['CATS']->getAccessLevel('contacts.editActivity') < ACCESS_LEVEL_EDIT)
{
$interface->outputXMLErrorPage(-1, ERROR_NO_PERMISSION);
die();
}

if (!$interface->isRequiredIDValid('activityID'))
{
$interface->outputXMLErrorPage(-1, 'Invalid activity ID.');
Expand Down
6 changes: 6 additions & 0 deletions ajax/testEmailSettings.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,12 @@
die();
}

if ($_SESSION['CATS']->getAccessLevel('settings.emailSettings.POST') < ACCESS_LEVEL_SA)
{
$interface->outputXMLErrorPage(-1, ERROR_NO_PERMISSION);
die();
}

$siteID = $interface->getSiteID();

if (!isset($_POST['testEmailAddress']) ||
Expand Down
26 changes: 26 additions & 0 deletions lib/Calendar.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -270,6 +270,32 @@ public function getAllEventTypes()
return $this->_db->getAllAssoc($sql);
}

/**
* Returns a calendar event.
*
* @param integer Calendar Event ID.
* @return array Calendar event data array, or empty array if no record
* is present.
*/
public function get($eventID)
{
$sql = sprintf(
"SELECT
calendar_event.calendar_event_id AS eventID,
calendar_event.entered_by AS enteredBy
FROM
calendar_event
WHERE
calendar_event.calendar_event_id = %s
AND
calendar_event.site_id = %s",
$this->_db->makeQueryInteger($eventID),
$this->_siteID
);

return $this->_db->getAssoc($sql);
}

/**
* Adds a calendar event to the database.
*
Expand Down
28 changes: 26 additions & 2 deletions modules/calendar/CalendarUI.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -582,6 +582,19 @@ private function onEditEvent()

$eventID = $_POST['eventID'];
$type = $_POST['type'];
$calendar = new Calendar($this->_siteID);
$eventRS = $calendar->get($eventID);

if (empty($eventRS))
{
CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid event ID.');
}

if ($eventRS['enteredBy'] != $this->_userID &&
$this->getUserAccessLevel('calendar.show') < ACCESS_LEVEL_SA)
{
CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
}

if ($_POST['allDay'] == 1)
{
Expand Down Expand Up @@ -662,7 +675,6 @@ private function onEditEvent()
if (!eval(Hooks::get('CALENDAR_EDIT_PRE'))) return;

/* Update the event. */
$calendar = new Calendar($this->_siteID);
if (!$calendar->updateEvent($eventID, $type, $date, $description,
$allDay, $dataItemID, $dataItemType, 'NULL', $title, $duration,
$reminderEnabled, $reminderEmail, $reminderTime, $publicEntry,
Expand Down Expand Up @@ -711,10 +723,22 @@ private function onDeleteEvent()
}

$eventID = $_POST['eventID'];
$calendar = new Calendar($this->_siteID);
$eventRS = $calendar->get($eventID);

if (empty($eventRS))
{
CommonErrors::fatal(COMMONERROR_BADINDEX, $this, 'Invalid event ID.');
}

if ($eventRS['enteredBy'] != $this->_userID &&
$this->getUserAccessLevel('calendar.show') < ACCESS_LEVEL_SA)
{
CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
}

if (!eval(Hooks::get('CALENDAR_DELETE_PRE'))) return;

$calendar = new Calendar($this->_siteID);
$calendar->deleteEvent($eventID);

if (!eval(Hooks::get('CALENDAR_DELETE_POST'))) return;
Expand Down
5 changes: 5 additions & 0 deletions modules/import/ImportUI.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,6 +154,11 @@ public function handleRequest()
*/
private function revert()
{
if ($this->getUserAccessLevel('import.import') < ACCESS_LEVEL_EDIT)
{
CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
}

if (!$this->isRequiredIDValid('importID', $_POST))
{
$this->import();
Expand Down
6 changes: 6 additions & 0 deletions modules/lists/ajax/addToLists.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,12 @@ function isRequiredValueValid($value)
die();
}

if ($_SESSION['CATS']->getAccessLevel('lists') < ACCESS_LEVEL_EDIT)
{
$interface->outputXMLErrorPage(-1, ERROR_NO_PERMISSION);
die();
}

if (!isset($_POST['listsToAdd']))
{
$interface->outputXMLErrorPage(-1, 'No listsToAdd passed.');
Expand Down
6 changes: 6 additions & 0 deletions modules/lists/ajax/deleteList.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,12 @@
die();
}

if ($_SESSION['CATS']->getAccessLevel('lists') < ACCESS_LEVEL_EDIT)
{
$interface->outputXMLErrorPage(-1, ERROR_NO_PERMISSION);
die();
}

if (!isset($_POST['savedListID']) || !ctype_digit((string) $_POST['savedListID']))
{
$interface->outputXMLErrorPage(-1, 'Invalid saved list ID.');
Expand Down
6 changes: 6 additions & 0 deletions modules/lists/ajax/editListName.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,12 @@
die();
}

if ($_SESSION['CATS']->getAccessLevel('lists') < ACCESS_LEVEL_EDIT)
{
$interface->outputXMLErrorPage(-1, ERROR_NO_PERMISSION);
die();
}

if (!isset($_POST['savedListID']) || !ctype_digit((string) $_POST['savedListID']))
{
$interface->outputXMLErrorPage(-1, 'Invalid saved list ID.');
Expand Down
6 changes: 6 additions & 0 deletions modules/lists/ajax/newList.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,12 @@
die();
}

if ($_SESSION['CATS']->getAccessLevel('lists') < ACCESS_LEVEL_EDIT)
{
$interface->outputXMLErrorPage(-1, ERROR_NO_PERMISSION);
die();
}

if (!isset($_POST['dataItemType']) || !ctype_digit((string) $_POST['dataItemType']))
{
$interface->outputXMLErrorPage(-1, 'Invalid saved list type.');
Expand Down
34 changes: 34 additions & 0 deletions modules/reports/ReportsUI.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,35 +56,69 @@ public function handleRequest()
switch ($action)
{
case 'graphView':
if ($this->getUserAccessLevel('reports.graphView') < ACCESS_LEVEL_READ)
{
CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
}
$this->graphView();
break;

case 'generateJobOrderReportPDF':
if ($this->getUserAccessLevel('reports.generateJobOrderReportPDF') < ACCESS_LEVEL_READ)
{
CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
}
$this->generateJobOrderReportPDF();
break;

case 'showSubmissionReport':
if ($this->getUserAccessLevel('reports.showSubmissionReport') < ACCESS_LEVEL_READ)
{
CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
}
$this->showSubmissionReport();
break;

case 'showPlacementReport':
if ($this->getUserAccessLevel('reports.showPlacementReport') < ACCESS_LEVEL_READ)
{
CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
}
$this->showPlacementReport();
break;

case 'customizeJobOrderReport':
if ($this->getUserAccessLevel('reports.customizeJobOrderReport') < ACCESS_LEVEL_READ)
{
CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
}
$this->customizeJobOrderReport();
break;

case 'customizeEEOReport':
if ($this->getUserAccessLevel('reports.customizeEEOReport') < ACCESS_LEVEL_READ ||
!$_SESSION['CATS']->canSeeEEOInfo())
{
CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
}
$this->customizeEEOReport();
break;

case 'generateEEOReportPreview':
if ($this->getUserAccessLevel('reports.generateEEOReportPreview') < ACCESS_LEVEL_READ ||
!$_SESSION['CATS']->canSeeEEOInfo())
{
CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
}
$this->generateEEOReportPreview();
break;

case 'reports':
default:
if ($this->getUserAccessLevel('reports.show') < ACCESS_LEVEL_READ)
{
CommonErrors::fatal(COMMONERROR_PERMISSION, $this, 'Invalid user level for action.');
}
$this->reports();
break;
}
Expand Down
Loading