Mercurial > p > roundup > code
comparison doc/upgrading.txt @ 4308:b30bdfae4461
Fix security hole allowing user permission escalation
(thanks Ralf Schlatterbeck)
also update docs and prepare for a release
| author | Richard Jones <richard@users.sourceforge.net> |
|---|---|
| date | Sun, 20 Dec 2009 23:24:21 +0000 |
| parents | e16a1131ba67 |
| children | 8e0d350ce644 |
comparison
equal
deleted
inserted
replaced
| 4307:82f7f8708e1b | 4308:b30bdfae4461 |
|---|---|
| 13 | 13 |
| 14 .. contents:: | 14 .. contents:: |
| 15 | 15 |
| 16 Migrating from 1.4.x to 1.4.11 | 16 Migrating from 1.4.x to 1.4.11 |
| 17 ============================== | 17 ============================== |
| 18 | |
| 19 Close poential security hole | |
| 20 ---------------------------- | |
| 21 | |
| 22 If your tracker has untrusted users you should examine its ``schema.py`` | |
| 23 file and look for the section granting the "Edit" permission to your users. | |
| 24 This should look something like:: | |
| 25 | |
| 26 p = db.security.addPermission(name='Edit', klass='user', check=own_record, | |
| 27 description="User is allowed to edit their own user details") | |
| 28 | |
| 29 and should be modified to restrict the list of properties they are allowed | |
| 30 to edit by adding the ``properties=`` section like:: | |
| 31 | |
| 32 p = db.security.addPermission(name='Edit', klass='user', check=own_record, | |
| 33 properties=('username', 'password', 'address', 'realname', 'phone', | |
| 34 'organisation', 'alternate_addresses', 'queries', 'timezone'), | |
| 35 description="User is allowed to edit their own user details") | |
| 36 | |
| 37 Most importantly the "roles" property should not be editable - thus not | |
| 38 appear in that list of properties. | |
| 39 | |
| 18 | 40 |
| 19 Grant the "Register" permission to the Anonymous role | 41 Grant the "Register" permission to the Anonymous role |
| 20 ----------------------------------------------------- | 42 ----------------------------------------------------- |
| 21 | 43 |
| 22 A separate "Register" permission has been introduced to allow | 44 A separate "Register" permission has been introduced to allow |