fix: add missing authorization to the history plugin and the working version preview - #6618
Merged
Conversation
Restoring a snapshot and listing the snapshots of an article only required the `history[article_rollback]` permission, without any check whether the user may access the target article. Any editor with that permission could therefore roll back or enumerate the content of arbitrary articles in arbitrary languages. The frontend preview had the same gap and rendered historic content - including content that has been removed since - of articles the user has no permission for.
The frontend preview of the working version was only gated by `rex_backend_login::hasSession()`, which merely looks for a user id in the session. Neither the category nor the clang permission was checked, so any backend user - even one who may only access the media pool - could read the working version, and therefore unpublished content, of any article in any language. - use `createUser()` instead of `hasSession()`, so session expiry as well as the status and the password of the user are validated - check the category and clang permission of the article whose slices are actually fetched - limit the preview to the requested article, so articles embedded via `REX_ARTICLE[]` keep their live version instead of exposing their working version The last point also requires skipping plain `rex_article_content_base` instances: those are used to write the article cache, and switching them to the working version would persist unpublished content into a cache file that is served to everybody.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Both the history snapshots (backend and frontend preview) and the frontend preview of the working version were shown without checking whether the user may access the article and language at all.
Details are intentionally brief here — the relevant parts are only mentioned in the commit messages for now and will be described properly once released.