Users are able to change the linked user, but not the supposed fields #509

New issue

Closed

opened 2021-09-26 00:27:04 +02:00 by tteichler · 9 comments

tteichler commented 2021-09-26 00:27:04 +02:00

Owner

Copy link

If you allow users to edit fields on themselves (e.g. last_name), they are theoretically able to change the linked user. Django will throw an error because django.db.utils.IntegrityError: duplicate key value violates unique constraint "core_person_user_id_key", but this is not an security feature…

Funniest thing about: Users are NOT able to change the configured allowed fields.

If you allow users to edit fields on themselves (e.g. last_name), they are theoretically able to change the linked user. Django will throw an error because `django.db.utils.IntegrityError: duplicate key value violates unique constraint "core_person_user_id_key"`, but this is not an security feature… Funniest thing about: Users are NOT able to change the configured allowed fields.

tteichler commented 2021-09-26 00:27:04 +02:00

Author

Owner

Copy link

assigned to @debdolph

assigned to @debdolph

tteichler commented 2021-09-26 00:27:16 +02:00

Author

Owner

Copy link

created merge request !2362 to address this issue

created merge request !2362 to address this issue

tteichler commented 2021-09-26 00:27:16 +02:00

Author

Owner

Copy link

mentioned in merge request !2362

mentioned in merge request !2362

hansegucker commented 2021-10-22 11:39:21 +02:00

Owner

Copy link

changed the description

changed the description

hansegucker commented 2021-10-25 17:37:54 +02:00

Owner

Copy link

assigned to @hansegucker and unassigned @debdolph

assigned to @hansegucker and unassigned @debdolph

hansegucker commented 2021-10-25 19:31:37 +02:00

Owner

Copy link

changed title from Users are able to change the linked user to Users are able to change the linked user{+, but not the supposed fields+}

changed title from **Users are able to change the linked user** to **Users are able to change the linked user{+, but not the supposed fields+}**

hansegucker commented 2021-10-25 19:31:50 +02:00

Owner

Copy link

created merge request !2397 to address this issue

created merge request !2397 to address this issue

hansegucker commented 2021-10-25 19:31:50 +02:00

Owner

Copy link

mentioned in merge request !2397

mentioned in merge request !2397

nik closed this issue 2021-10-25 20:23:16 +02:00

nik commented 2021-10-25 20:23:17 +02:00

Owner

Copy link

mentioned in commit 1290e631a4

mentioned in commit 1290e631a45995249c41ab27eaf75b2a02b4f789

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

master

3960-extend-slideiterator

1625-migrate-to-vuetify-4

remove-vite-legacy-plugin

weblate-frontend

weblate

renovate/selenium-4.x

1644-dahsboard-widget-creation-broken

renovate/node-26.x

renovate/django-health-check-4.x

renovate/django-countries-9.x

1643-calendar-dashboardwidgets-throw-500er-error

renovate/django-dbbackup-5.x

1064-backchannel-logout

sis2-with-sl

fix/adapt-some-urls

1533-notifications-reminders-for-events-todos

1294-expose-free-busy-state-in-ui-for-personal-events

1303-correctly-implement-recurring-todos-with-amends-recurrence-id

1345-introduce-annotate-methods-for-more-person-related-rules

1603-search-index-is-deleted-on-cache-flush

1068-oidc-rp-initiated-registration

1065-oidc-device-code-grant-flow

1599-vite-build-fails-with-too-many-apps

fix/sort-models

1066-oidc-dynamic-client-registration

tmp-ticdesk-dev

ticdesk-search-map

cherry-pick-2b8d2e01

643-one-time-login-links

1461-birthday-calendar-oom

tmp-ticdesk-related-names-for-paweljong

1459-manifest-json-not-found

integrate-disable-into-usecrud

update-container-image-base-to-trixie

check/update-pyproject-toml

check/update-builddeps-package-json

check/update-prettier-ignore

1445-todo-list-broken

1364-track-date-of-beginning-and-end-of-group-membership

1259-generalise-places

use-object-form-reactivity

1435-cruddaylist-does-not-detect-changes-in-existing-intervals

tmp-ticdesk

stable/4.0.0

1366-frontend-for-creating-and-modifying-generic-personrelationships

master-without-vue-3

1376-expand-row-feature-of-v-data-table-doesn-t-work-when-items-include-date-time-objects

release/4.1.0.dev2

1372-fix-import-of-crudlist

1353-adapt-chipselectfield

check/update-eslint-rc-js

check/update-tox-ini

improve-selenium-startup

1268-add-specific-availability-planning-frontend

1343-fix-person-related-permissions

newer-and-rebased-migrate-crud-to-vue-3-and-generalize

1314-fix-handling-of-end-datetime-in-calendar-events-query

migrate-to-uv

tmp-ticdesk-4-0

fix-inline-crud-list-is-create

tmp-split-calendar-event-dialog

release/4.1.0

1260-refactor-account-registration-form-and-generalize-parts-of-it

add-datacheck-fix-in-changelog

1232-group-calendars

1251-registryobjects-are-their-own-parent-registries

1209-introduce-django-rest-framework-serializers

1162-strange-behaviour-with-personal-events

revert-7fe8b8b1

check/delete-eslint-rc-js

check/update-gitignore

stable-3.2

stable-3.1

update/eslint

1158-add-sorting-functionality-to-get_single_events

1055-introduce-sub-school-terms

1082-colorfield-sometimes-returns-8-digit-alpha-color-hex-code

test-build

emit-extracted-items-from-save-event

886-prevent-graphql-query-mutation-name-collisions

release/3.2.1

1038-make-dialogobjectform-send-a-diff-on-edit-instead-of-the-whole-object

release/3.1.6

fix/counter-chip

1021-allow-matching-of-social-accounts-to-local-accounts-by-email

991-set-title-attribute-for-all-unclear-frontend-spots

update-docs-without-release-distribution

850-do-not-restart-vite-serve-on-every-uwsgi-reload

991-use-tooltips-for-all-unclear-frontend-spots

983-add-groups-by-person-query

826-otp-token-emails-don-t-contain-anything-besides-the-token

781-error-if-creating-a-new-school-term-without-a-start-and-end-date

966-allow-setting-of-custom-queryset-when-creating-calendar-feeds

tmp-for-add-simple-course-book-list

release/3.2.0

868-introduce-uuid-field-for-extensiblemodel

958-introduce-parent-model-resource

954-evaluate-strawberry-and-strawberry-django

948-error-handling-with-personal-event-creation-is-not-usable

fix-custom-events-fss

923-introduce-vue-styleguidist

899-move-person-type-fields-into-constant

892-remove-model-extension-api

manage-holidays

831-data-management-for-the-model-room

fix/oauth-toolkit-migration

release-3.0

stable-2.12

819-fix-some-minor-issues-in-graphql-queries

fix-container-image

stable-2.11

stable-2.10

stable-2.13

806-expose-string-representation-of-models-via-graphql-api

800-move-generic-components-from-aleksis-app-plank-to-core

debug-foo

oidc-docs

migrate-to-vue3

789-remove-syncable-fields

remove/ical-feed

194-enable-async-framework-channels

726-dynamically-build-vue-forms

766-selfclosing-components-in-vue_base-html-break-the-page

492-follow-up-view_persons_rule-not-usable-due-to-use-of-queryset_rules_filter

751-include-fields-of-non-extensible-model-in-syncable-fields

kort-core

feature/vuejs

717-docker-improve-image-size-by-fixing-cleanup-layer

build-improvements

697-3-0-meta-issue-for-graphql-back-end-and-vue-js-frontend

185-create-notifications-for-announcement

stable-2.7

update/translation-files-13

update/translation-files-12

599-add-oauth-oidc-tests

i10n-ru-ua

tmp/cbes

do-release-2.9

docs/notifications

180-add-template-management

fix-import

653-remove-cachalot

635-test-e-mail-button

397-dedicated-public-dashboard

396-external-link-widet-auto-discovery

511-allow-custom-redirect-uri-schemes

update/translation-files-8

585-barcode-widget-for-person-fields

dot-1.6.2

281-corporate-design-for-html-mails

592-oauth2-broken-in-2-4

574-rewrite-password-change-templates

reduce-docker-steps

571-age-calculation-broken

559-oauth-add-feature-to-limit-apps-to-groups

feature/push-notifications

feature/i18n-maintenance

fix/oauth-skip-auth-detail

523-integrate-sentry-for-performance-and-error-tracing

prepare-release-2.1.dev0

release/2.0

387-jwt-provider-consumer-support

update/translation-files

496-service-worker-safari-does-not-support-broadcastchannel-api

group-members-permissions

prepare-release-2.0b2

fix/trans-conflicts

bp-2.0-use-importlib-instead-of-pkg-resources

update/translation-files-2.0b0-1

test-migration-test

376-prevent-deep-linking-to-media-files

feature/build-icons-automatically

421-update-to-django-3-2

set-sast-config-1

feature/test-selenium-capabilities

arg-apps

feature/review-app

test-docker-app-version

feature/allow-app-source

fix-ci-config

feature/curlylint

feature/gin-index-on-ext-data

backup-over-ssh

feature/keep_local_password_ldap

340-correctly-implement-the-ckeditor

143-mark-menu-entries-as-active-with-sub-sub-menu-entries

feature/django-notifs

2021-update-copyright

catch-error

update/poetry

selenium

269-photo-cropping-broken-2

269-photo-cropping-broken

fix-docker-build

has-person

update-poetry-lockfile

pages-staging

mix/conn-dne

236-support-saml-and-oauth2-logins-as-consumer

feature/custom-auth-backends-dev

dev

fix-isort

214-add-notification-dashboard-widget-anything-to-notify-of-upcoming-birthdays

157-include-django-letsagree

215-add-geolocation-of-persons

267-lint-add-spell-check

291-rename-template-references

270-ci-replace-kaniko-with-buildah

217-add-support-for-defining-group-types

feature/docker-extras

153-use-complex-name-field-with-i18n-support

debug-docker-build

feature/material-admin

pages-jonglieren

179-group-contact

169-support-nextcloud-talk-for-notifications

develop-dashboard-feeds

134-merge-dashboard-ajax

5.3.0

5.2.0

5.1.0

5.0.3

5.0.2

5.0.1

5.0.0

5.0.0b3

5.0.0b2

5.0.0b1

5.0.0b0

4.1.0.dev2

4.0.4

4.1.0.dev1

4.1.0.dev0

4.0.3

4.0.2

4.0.1

4.0.0

4.0.0.dev16

3.2.2

3.1.7

4.0.0.dev15

4.0.0.dev14

4.0.0.dev13

4.0.0.dev12

4.0.0.dev11

3.1.6

3.2.1

4.0.0.dev10

4.0.0.dev9

4.0.0.dev8

4.0.0.dev7

4.0.0.dev6

4.0.0.dev5

4.0.0.dev4

4.0.0.dev3

4.0.0.dev2

4.0.0.dev1

3.2.0

3.1.5

3.1.4

3.1.3

3.1.2

3.1.1

3.1

3.0

2.12.4

3.0b3

3.0b2

2.10.3

2.11.2

2.12.3

3.0b1

3.0b0

3.0.dev3

2.12.2

3.0.dev2

2.12.1

2.12

2.11.1

2.11

2.10.2

3.0.dev1

2.10.2.dev0

3.0.dev0

2.10.1

2.10

2.7.6

2.7.5

2.9

2.8.2.dev2

2.8.2.dev1

2.8.2.dev0

2.8.1

2.8.1.dev0

2.8

2.7.4

2.7.3

2.7.2

2.7.1

2.7

2.6

2.5

2.4

2.3.2

2.3.1

2.3

2.2.1

2.2

2.1.1

2.1

2.1.dev0

2.0

2.0rc7

2.0rc6

2.0rc5

2.0rc4

2.0rc3

2.0rc2

2.0rc1

2.0b2

2.0b1

2.0b0

2.0a4

2.0a3

2.0a2

2.0a1

1.0a3.1

1.0a3

1.0a2

1.0a1

1.0a0

0.1

Labels

Clear labels   

Security

  

TeX

Needs LaTeX template

  

auto-update

  

board

done

  

board

ready

  

board

todo

  

check

delete-eslint-rc-js

  

check

update-builddeps-package-json

  

check

update-eslint-rc-js

  

check

update-gitignore

  

check

update-merge-request-template

  

check

update-prettier-ignore

  

check

update-pyproject-toml

  

check

update-renovate-json

  

check

update-tox-ini

  

part

backend

Backend (view code, models, logic, etc.)

  

part

ci

  

part

docs

Issue or addition to the documentation

  

part

frontend

Frontend (templates, etc.)

  

part

i18n

Translation or internationalisation issue

  

part

non-technical

Non-technical (policy, maintenance, etc.) issue or discussion

  

part

packaging

Issue concerning the packaging of AlekSIS and components

  

prio

1

Priority High

  

prio

2

Priority Medium

  

prio

3

Priority Low

  

release-mr-5.x

  

size

large

  

size

medium

  

size

small

  

source

customer

Requested by a customer or affiliated user

  

source

customer::fsmw

  

source

customer::fss

  

source

customer::teckids

  

source

downstream

Issue or merge request from other projects using AlekSIS or parts of it

  

type

breaking

  

type

bug

Bug

  

type

feature

New feature

  

type

refactoring

  

workflow

blocked

Issue is blocked by another issue

  

workflow

confirmed

The bug is reproducible and will be fixed

  

workflow

current-todo

  

workflow

discussing

Needs to be discussed before implementation

  

workflow

new-app

Requires new AlekSIS app, which has to be created

  

workflow

wontfix

The bug is not reproducible or the feature was decided against

No labels

Security

TeX

auto-update

board

done

board

ready

board

todo

check

delete-eslint-rc-js

check

update-builddeps-package-json

check

update-eslint-rc-js

check

update-gitignore

check

update-merge-request-template

check

update-prettier-ignore

check

update-pyproject-toml

check

update-renovate-json

check

update-tox-ini

part

backend

part

ci

part

docs

part

frontend

part

i18n

part

non-technical

part

packaging

prio

1

prio

2

prio

3

release-mr-5.x

size

large

size

medium

size

small

source

customer

source

customer::fsmw

source

customer::fss

source

customer::teckids

source

downstream

type

breaking

type

bug

type

feature

type

refactoring

workflow

blocked

workflow

confirmed

workflow

current-todo

workflow

discussing

workflow

new-app

workflow

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

hansegucker

3 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

aleksis/AlekSIS-Core#509

No description provided.