Mercurial > p > roundup > code
comparison roundup/xmlrpc.py @ 4437:261c9f913ff7
- Add explicit "Search" permissions, see Security Fix below.
- Security Fix: Add a check for search-permissions: now we allow
searching for properties only if the property is readable without a
check method or if an explicit search permission (see above unter
"Features) is given for the property. This fixes cases where a user
doesn't have access to a property but can deduce the content by
crafting a clever search, group or sort query.
see doc/upgrading.txt for how to fix your trackers!
| author | Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net> |
|---|---|
| date | Tue, 19 Oct 2010 15:29:05 +0000 |
| parents | 40d7414592ac |
| children | 3f251efd5f48 |
comparison
equal
deleted
inserted
replaced
| 4436:528ace81fd16 | 4437:261c9f913ff7 |
|---|---|
| 87 return result | 87 return result |
| 88 | 88 |
| 89 def filter(self, classname, search_matches, filterspec, | 89 def filter(self, classname, search_matches, filterspec, |
| 90 sort=[], group=[]): | 90 sort=[], group=[]): |
| 91 cl = self.db.getclass(classname) | 91 cl = self.db.getclass(classname) |
| 92 uid = self.db.getuid() | |
| 93 security = self.db.security | |
| 94 filterspec = security.filterFilterspec (uid, classname, filterspec) | |
| 95 sort = security.filterSortspec (uid, classname, sort) | |
| 96 group = security.filterSortspec (uid, classname, group) | |
| 92 result = cl.filter(search_matches, filterspec, sort=sort, group=group) | 97 result = cl.filter(search_matches, filterspec, sort=sort, group=group) |
| 93 return result | 98 check = security.hasPermission |
| 99 x = [id for id in result if check('View', uid, classname, itemid=id)] | |
| 100 return x | |
| 94 | 101 |
| 95 def display(self, designator, *properties): | 102 def display(self, designator, *properties): |
| 96 classname, itemid = hyperdb.splitDesignator(designator) | 103 classname, itemid = hyperdb.splitDesignator(designator) |
| 97 cl = self.db.getclass(classname) | 104 cl = self.db.getclass(classname) |
| 98 props = properties and list(properties) or cl.properties.keys() | 105 props = properties and list(properties) or cl.properties.keys() |