Anonymous users can edit other anonymous users forms

Next topic

Author	Message
Atle Pedersen	Monday 26 February 2007 8:27:56 am For example, go to a random documentation page on ez.no. Start adding a comment as anonymous user. Use another browser/computer and go to the same content/edit url, and you will be able to edit the form there. This is a security problem when developing a site for a customer who needs external anonymous users to create new objects. As it is, other people can get the information from any partly stored object. I've searched for more on this issue, and found an old bug repport, that says this is a fixed bug (ref: http://issues.ez.no/6680). However, to me the bug appears to still exist. Could there be some ini setting I've missed? I've made sure that the content/edit policy has limitation owner(self). So is this a bug, or is there some settings I've missed?
Claudia Kosny	Monday 26 February 2007 9:02:05 am Hi Atle I can't check test this right now but wasn't there an limition to 'self or anonymous users per http session' for content editing? Maybe this means that anonymous users are indentified by their session so they could not edit the content of other users. If you try it out, please report back. Claudia
Atle Pedersen	Monday 26 February 2007 10:24:32 am Thanks for the suggestion, it sounds logical. Unfortunately I couldn't get it to work though. I also tried changing the [Session] SessionNameHandler=default between default and custom. I'll have to look more into it again tomorrow.

Author

Message

Monday 26 February 2007 8:27:56 am

For example, go to a random documentation page on ez.no. Start adding a comment as anonymous user. Use another browser/computer and go to the same content/edit url, and you will be able to edit the form there.

This is a security problem when developing a site for a customer who needs external anonymous users to create new objects. As it is, other people can get the information from any partly stored object.

I've searched for more on this issue, and found an old bug repport, that says this is a fixed bug (ref: http://issues.ez.no/6680). However, to me the bug appears to still exist. Could there be some ini setting I've missed?

I've made sure that the content/edit policy has limitation owner(self).

So is this a bug, or is there some settings I've missed?

Claudia Kosny

Monday 26 February 2007 9:02:05 am

Hi Atle

I can't check test this right now but wasn't there an limition to 'self or anonymous users per http session' for content editing? Maybe this means that anonymous users are indentified by their session so they could not edit the content of other users. If you try it out, please report back.

Claudia

Atle Pedersen

Monday 26 February 2007 10:24:32 am

Thanks for the suggestion, it sounds logical. Unfortunately I couldn't get it to work though.

I also tried changing the
[Session]
SessionNameHandler=default
between default and custom.

I'll have to look more into it again tomorrow.

eZ debug

Timing:	Jan 18 2025 19:05:59
Script start
Timing:	Jan 18 2025 19:05:59
Module start 'layout'
Timing:	Jan 18 2025 19:05:59
Module start 'content'
Timing:	Jan 18 2025 19:06:00
Module end 'content'
Timing:	Jan 18 2025 19:06:00
Script end

Main resources:

Total runtime	0.7312 sec
Peak memory usage	4,096.0000 KB
Database Queries	57

Timing points:

Checkpoint	Start (sec)	Duration (sec)	Memory at start (KB)	Memory used (KB)
Script start	0.0000	0.0092	589.4922	152.6406
Module start 'layout'	0.0092	0.0033	742.1328	39.4766
Module start 'content'	0.0125	0.7171	781.6094	502.4766
Module end 'content'	0.7297	0.0015	1,284.0859	12.1250
Script end	0.7311		1,296.2109

Time accumulators:

Accumulator	Duration (sec)	Duration (%)	Count	Average (sec)
Ini load
Load cache	0.0035	0.4756	16	0.0002
Check MTime	0.0013	0.1733	16	0.0001
Mysql Total
Database connection	0.0016	0.2197	1	0.0016
Mysqli_queries	0.6768	92.5691	57	0.0119
Looping result	0.0005	0.0710	55	0.0000
Template Total	0.6953	95.1	2	0.3477
Template load	0.0022	0.2962	2	0.0011
Template processing	0.6931	94.7978	2	0.3466
Template load and register function	0.0001	0.0183	1	0.0001
states
state_id_array	0.0007	0.0968	1	0.0007
state_identifier_array	0.0013	0.1769	2	0.0006
Override
Cache load	0.0018	0.2405	21	0.0001
Sytem overhead
Fetch class attribute can translate value	0.0007	0.1015	2	0.0004
Fetch class attribute name	0.0021	0.2909	4	0.0005
XML
Image XML parsing	0.0028	0.3866	2	0.0014
class_abstraction
Instantiating content class attribute	0.0000	0.0016	5	0.0000
General
dbfile	0.0037	0.5028	16	0.0002
String conversion	0.0000	0.0011	4	0.0000
Note: percentages do not add up to 100% because some accumulators overlap

Templates used to render the page:

Usage	Requested template	Template	Template loaded
1	node/view/full.tpl	full/forum_topic.tpl	extension/sevenx/design/simple/override/templates/full/forum_topic.tpl
2	content/datatype/view/ezimage.tpl	<No override>	extension/sevenx/design/simple/templates/content/datatype/view/ezimage.tpl
3	content/datatype/view/ezxmltext.tpl	<No override>	extension/community_design/design/suncana/templates/content/datatype/view/ezxmltext.tpl
4	content/datatype/view/ezxmltags/paragraph.tpl	<No override>	extension/ezwebin/design/ezwebin/templates/content/datatype/view/ezxmltags/paragraph.tpl
1	content/datatype/view/ezxmltags/line.tpl	<No override>	design/standard/templates/content/datatype/view/ezxmltags/line.tpl
1	print_pagelayout.tpl	<No override>	extension/community/design/community/templates/print_pagelayout.tpl
Number of times templates used: 12 Number of unique templates used: 6

Time used to render debug report: 0.0001 secs