Bug 829421 (CVE-2012-2680)

Fixed in revision 5398 on trunk.

Essentially, a fragment from the existing authentication check on the index.html page has been added to all widgets.  The check can be enabled or disabled, and is disabled by default.  For widgets in the page hierarchy, the check is enabled except where necessary for actual login -- the login page itself, and the css and resource pages which allow it to draw.  

Here is the diff from the commit email for reference:

Modified: trunk/cumin/python/cumin/account/widgets.py
===================================================================
--- trunk/cumin/python/cumin/account/widgets.py 2012-06-01 15:51:07 UTC (rev 5397)
+++ trunk/cumin/python/cumin/account/widgets.py 2012-06-01 21:16:27 UTC (rev 5398)
@@ -76,6 +76,10 @@
         form = LoginForm(app, "form")
         self.add_child(form)
 
+        # Make sure that we don't force a user to 
+        # be logged in when visiting the login page!
+        self.check_login = False
+
     def do_process(self, session):
         if self.logout.get(session):
             try:

Modified: trunk/wooly/python/wooly/__init__.py
===================================================================
--- trunk/wooly/python/wooly/__init__.py        2012-06-01 15:51:07 UTC (rev 5397)
+++ trunk/wooly/python/wooly/__init__.py        2012-06-01 21:16:27 UTC (rev 5398)
@@ -114,6 +114,7 @@
         self.update_enabled = False
         self.defer_enabled = False
         self.comments_enabled = True
+        self.check_login = False
 
         # These are computed later in the init pass
         self.ancestors = None
@@ -292,7 +293,23 @@
         # when a user is not authorized for this widget.
         pass
 
+    def authorized(self, session):
+        login = session.client_session.attributes.get("login_session")
+        if login:
+            when = datetime.now() - timedelta(hours=24)
+            if login.created > when:
+                return True
+        return False
+
     def process(self, session, *args):
+        if self.check_login and not self.authorized(session):
+            # redirect to the login page
+            page = self.app.login_page
+            sess = Session(page)
+            page.origin.set(sess, session.marshal())
+            self.redirect.set(session, sess.marshal())
+            return
+
         if not self.app.authorize_cb(session, self):
             self.redirect_on_not_authorized(session)
         else:
@@ -424,6 +441,10 @@
         self.profile = self.ProfileAttribute(app, "profile")
         self.add_attribute(self.profile)
 
+        # All pages should only be processed if the user
+        # is logged in, except for the login page, resource, and css.
+        self.check_login = True
+
     def init_computed_values(self):
         self.ancestors = ()
         self.path = ""

Modified: trunk/wooly/python/wooly/pages.py
===================================================================
--- trunk/wooly/python/wooly/pages.py   2012-06-01 15:51:07 UTC (rev 5397)
+++ trunk/wooly/python/wooly/pages.py   2012-06-01 21:16:27 UTC (rev 5398)
@@ -335,6 +335,7 @@
         self.html_page = html_page
         self.__then = datetime.utcnow()
         self.__css = None
+        self.check_login = False
 
     def get_last_modified(self, session):
         return self.__then
@@ -430,6 +431,7 @@
         self.add_parameter(self.rname)
 
         self.then = datetime.utcnow()
+        self.check_login = False
 
     def get_last_modified(self, session):
         return self.then

svn diff -c 5398 http://svn.fedorahosted.org/svn/cumin

Acknowledgements:

These issues were discovered by Florian Weimer of the Red Hat Product Security Team.

This issue has been addressed in following products:

  MRG for RHEL-5 v. 2

Via RHSA-2012:1278 https://rhn.redhat.com/errata/RHSA-2012-1278.html

This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2012:1281 https://rhn.redhat.com/errata/RHSA-2012-1281.html

Created cumin tracking bugs for this issue

Affects: fedora-all [bug 858868]