MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

Fix to a critical vulnerability for the login authentication mechanism 

- The API key check was incorrectly logging in the wrong user when the API key started with a numeric value
pull/976/head v2.4.21
Iglocska 2016-02-19 12:40:50 +01:00
parent 71b2446469
commit 77c9ce3b73
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/Controller/AppController.php
View File

@ -382,7 +382,7 @@ class AppController extends Controller {
public function checkAuthUser($authkey) {
$this->loadModel('User');
$this->User->recursive = -1;
$user = $this->User->getAuthUser($authkey);
$user = $this->User->getAuthUserByUuid($authkey);
if (empty($user)) return false;
if ($user['Role']['perm_site_admin']) $user['siteadmin'] = true;
return $user;

16
app/Model/User.php
View File

@ -433,7 +433,21 @@ class User extends AppModel {
// get the current user and rearrange it to be in the same format as in the auth component
public function getAuthUser($id) {
$user = $this->find('first', array('conditions' => array('OR' => array('User.id' => $id, 'User.authkey' => $id)), 'recursive' => -1,'contain' => array('Organisation', 'Role', 'Server')));
$conditions = array('User.id' => $id);
$user = $this->find('first', array('conditions' => $conditions, 'recursive' => -1,'contain' => array('Organisation', 'Role', 'Server')));
if (empty($user)) return $user;
// Rearrange it a bit to match the Auth object created during the login
$user['User']['Role'] = $user['Role'];
$user['User']['Organisation'] = $user['Organisation'];
$user['User']['Server'] = $user['Server'];
unset($user['Organisation'], $user['Role'], $user['Server']);
return $user['User'];
}
// get the current user and rearrange it to be in the same format as in the auth component
public function getAuthUserByUuid($id) {
$conditions = array('User.authkey' => $id);
$user = $this->find('first', array('conditions' => $conditions, 'recursive' => -1,'contain' => array('Organisation', 'Role', 'Server')));
if (empty($user)) return $user;
// Rearrange it a bit to match the Auth object created during the login
$user['User']['Role'] = $user['Role'];