Contrib.social

CommentAccessControlHandler::checkCreateAccess() does not check commented entity's comment field's status property

Open on Drupal.org →
Created on 29 June 2023, over 1 year ago
Updated 5 July 2023, over 1 year ago

Problem/Motivation

This has been discussed with the security team and was agreed to be made public
The comment module has an access bypass vulnerability.

Steps to reproduce

1. Enabling the comment and jsonapi modules
2. Enabling "Accept all JSON:API create, read, update, and delete operations." for jsonapi module
3. Configure node type to receive comments
4. Create a node with comments status Closed
5. As a user with "Post comments" permission create comment through jsonapi

As a result, when comments status is Closed users should not be able to post comments, but jsonap module ignores this per-node configuration field. A similar issue with comments status is Hidden.

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

🐛 Bug report
Status

Fixed

Version

10.1 ✨

Component
Comment  →

Last updated 11 days ago

Created by

🇦🇺Australia larowlan 🇦🇺🏝.au GMT+10

Live updates comments and jobs are added and updated live.
  • Security

    It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupal’s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the “Report a security vulnerability” link in the project page’s sidebar. See how to report a security issue for details.

  • Security improvements

    It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.

Sign in to follow issues

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024