Florian Weimer reported multiple instances of unprotected access (web pages, export functionality, image viewing) in cumin. An unauthenticated user could view pages that should have been restricted to authenticated users only, resulting in information disclosure.
Fixed in revision 5398 on trunk. Essentially, a fragment from the existing authentication check on the index.html page has been added to all widgets. The check can be enabled or disabled, and is disabled by default. For widgets in the page hierarchy, the check is enabled except where necessary for actual login -- the login page itself, and the css and resource pages which allow it to draw. Here is the diff from the commit email for reference: Modified: trunk/cumin/python/cumin/account/widgets.py =================================================================== --- trunk/cumin/python/cumin/account/widgets.py 2012-06-01 15:51:07 UTC (rev 5397) +++ trunk/cumin/python/cumin/account/widgets.py 2012-06-01 21:16:27 UTC (rev 5398) @@ -76,6 +76,10 @@ form = LoginForm(app, "form") self.add_child(form) + # Make sure that we don't force a user to + # be logged in when visiting the login page! + self.check_login = False + def do_process(self, session): if self.logout.get(session): try: Modified: trunk/wooly/python/wooly/__init__.py =================================================================== --- trunk/wooly/python/wooly/__init__.py 2012-06-01 15:51:07 UTC (rev 5397) +++ trunk/wooly/python/wooly/__init__.py 2012-06-01 21:16:27 UTC (rev 5398) @@ -114,6 +114,7 @@ self.update_enabled = False self.defer_enabled = False self.comments_enabled = True + self.check_login = False # These are computed later in the init pass self.ancestors = None @@ -292,7 +293,23 @@ # when a user is not authorized for this widget. pass + def authorized(self, session): + login = session.client_session.attributes.get("login_session") + if login: + when = datetime.now() - timedelta(hours=24) + if login.created > when: + return True + return False + def process(self, session, *args): + if self.check_login and not self.authorized(session): + # redirect to the login page + page = self.app.login_page + sess = Session(page) + page.origin.set(sess, session.marshal()) + self.redirect.set(session, sess.marshal()) + return + if not self.app.authorize_cb(session, self): self.redirect_on_not_authorized(session) else: @@ -424,6 +441,10 @@ self.profile = self.ProfileAttribute(app, "profile") self.add_attribute(self.profile) + # All pages should only be processed if the user + # is logged in, except for the login page, resource, and css. + self.check_login = True + def init_computed_values(self): self.ancestors = () self.path = "" Modified: trunk/wooly/python/wooly/pages.py =================================================================== --- trunk/wooly/python/wooly/pages.py 2012-06-01 15:51:07 UTC (rev 5397) +++ trunk/wooly/python/wooly/pages.py 2012-06-01 21:16:27 UTC (rev 5398) @@ -335,6 +335,7 @@ self.html_page = html_page self.__then = datetime.utcnow() self.__css = None + self.check_login = False def get_last_modified(self, session): return self.__then @@ -430,6 +431,7 @@ self.add_parameter(self.rname) self.then = datetime.utcnow() + self.check_login = False def get_last_modified(self, session): return self.then
svn diff -c 5398 http://svn.fedorahosted.org/svn/cumin
Acknowledgements: These issues were discovered by Florian Weimer of the Red Hat Product Security Team.
This issue has been addressed in following products: MRG for RHEL-5 v. 2 Via RHSA-2012:1278 https://rhn.redhat.com/errata/RHSA-2012-1278.html
This issue has been addressed in following products: MRG for RHEL-6 v.2 Via RHSA-2012:1281 https://rhn.redhat.com/errata/RHSA-2012-1281.html
Created cumin tracking bugs for this issue Affects: fedora-all [bug 858868]