From c98e370326102dac0c7c16c9b556da018b41803b Mon Sep 17 00:00:00 2001 From: Vika Shleina Date: Wed, 21 Jul 2021 06:07:35 +0300 Subject: Fixed security hole where other people could delete YOUR posts. Yes, yours. You're welcome. --- src/micropub/post.rs | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) (limited to 'src/micropub') diff --git a/src/micropub/post.rs b/src/micropub/post.rs index eaa603a..95b4dd0 100644 --- a/src/micropub/post.rs +++ b/src/micropub/post.rs @@ -511,6 +511,17 @@ async fn process_json( "You need a `delete` scope to delete posts." ); } + // This special scope is not available through a token endpoint, since the + // authorization endpoint is supposed to reject any auth request trying to get this + // scope. It is intended for TRUSTED external services that need to modify the + // database while ignoring any access controls + if (url::Url::parse(url)?.origin().ascii_serialization() + "/") != user.me.as_str() && !user.check_scope("kittybox_internal:do_what_thou_wilt") { + return error_json!( + 403, + "forbidden", + "You're not allowed to delete someone else's posts." + ) + } if let Err(error) = req.state().storage.delete_post(&url).await { return Ok(error.into()); } @@ -524,6 +535,13 @@ async fn process_json( "You need an `update` scope to update posts." ); } + if (url::Url::parse(url)?.origin().ascii_serialization() + "/") != user.me.as_str() && !user.check_scope("kittybox_internal:do_what_thou_wilt") { + return error_json!( + 403, + "forbidden", + "You're not allowed to delete someone else's posts." + ) + } if let Err(error) = req.state().storage.update_post(&url, body.clone()).await { Ok(error.into()) } else { @@ -591,6 +609,13 @@ async fn process_form( } match form.iter().find(|(k, _)| k == "url") { Some((_, url)) => { + if (url::Url::parse(url)?.origin().ascii_serialization() + "/") != user.me.as_str() && !user.check_scope("kittybox_internal:do_what_thou_wilt") { + return error_json!( + 403, + "forbidden", + "You're not allowed to delete someone else's posts." + ) + } if let Err(error) = req.state().storage.delete_post(&url).await { return error_json!(500, "database_error", error); } -- cgit 1.4.1