[drupal-devel] [bug] Bypass access via comments

[chx]

Issue status update for http://drupal.org/node/19009

 Project:      Drupal
 Version:      cvs
 Component:    comment.module
 Category:     bug reports
 Priority:     critical
 Assigned to:  chx
 Reported by:  nazadus
 Updated by:   chx
-Status:       active
+Status:       patch
 Attachment:   http://drupal.org/files/issues/comment_reply_access_3.patch (1.61 KB)

OK, patch corrected.
I think adding node_access to node_load would break havoc 'cos there
are some routines (even in core) which do not check whether the
node_load was successful or not. This is a whole another topic, please
make another issue.
What we need, IMHO is to patch this quickly...


chx



Previous comments:
------------------------------------------------------------------------

March 16, 2005 - 20:39 : nazadus

I believe I have found a bug.
If you goto http://www.etherpunk.com/comment/reply/180  (possibly NSFW)
it allows you to view the posting (while you don't have permission to
actually post, it still allows the page to get displayed).
I found this out by using awstats on my box and found that a hidden
page was getting hit fairly common that I really don't want getting
shown (well, it's on the web, I know... but... I'd rather have more
controlled access).
Does this belong in the comment section for not obeying TAC?
Can anyone confirm this on their site?
Kenny


------------------------------------------------------------------------

March 16, 2005 - 21:02 : pyromanfo

That's definitely something you need to take up with the comment module
guys.  It's not just taxonomy access control either, it's the core
node_access hooks in Drupal.  If they'll just check that before
displaying a node for reply, that'd fix it no problem.


------------------------------------------------------------------------

March 16, 2005 - 21:20 : moshe weitzman

filed under comment.module ... note that my big comment patch gets rid
of this page entirely (consolidates under comment/edit) so it might
make sense to apply my patch instead of fixing this.


------------------------------------------------------------------------

March 20, 2005 - 03:14 : chx

Attachment: http://drupal.org/files/issues/comment_reply_access.patch (1.36 KB)

moshe , http://drupal.org/node/18656 this does not seem to affect the
permissions of the comment/reply path.
I think the approach I have taken is blatantly simple: literally check
for access.


------------------------------------------------------------------------

March 20, 2005 - 03:24 : chx

Attachment: http://drupal.org/files/issues/comment_reply_access_0.patch (1.51 KB)




------------------------------------------------------------------------

March 20, 2005 - 03:37 : chx

Attachment: http://drupal.org/files/issues/comment_reply_access_1.patch (1.56 KB)




------------------------------------------------------------------------

March 20, 2005 - 03:38 : chx

Attachment: http://drupal.org/files/issues/comment_reply_access_2.patch (1.56 KB)




------------------------------------------------------------------------

March 20, 2005 - 09:48 : Anonymous

The discovery of this patch makes me wonder, whether we shouldn't
centralize the access controll a bit more.
If a core module can show this kind of bug, contrib modules will almost
certainly.  I propose to do a node_access() check inside node_load.
Gerhard


------------------------------------------------------------------------

March 20, 2005 - 10:03 : Anonymous

I also don't think that the patch is working.
node_access(arg(2)) should probably be node_access('view', $node) and
the node needs loading before.
Gerhard