http://localhost/ticket/120 <p> Look for all places where model is accessed and check authorization is checked. </p> <p> Document holes (and, as necessary, suggestions for fixes) as new tickets. Likely areas that need looking at: </p> <ul><li>search i/f </li><li>package WUI commit </li></ul><p> Write holes are obviously much more significant to us than read holes. </p> en-us http://assets.okfn.org/p/ckan/img/ckan_logo_shortname.png http://localhost/ticket/120 Trac 0.12.3 rgrp Mon, 28 Sep 2009 09:31:43 GMT http://localhost/ticket/120#comment:1 http://localhost/ticket/120#comment:1 <ul> <li><strong>description</strong> modified (<a href="/ticket/120?action=diff&amp;version=1">diff</a>) </li> </ul> Ticket dread Thu, 01 Oct 2009 14:15:44 GMT http://localhost/ticket/120#comment:2 http://localhost/ticket/120#comment:2 <ul> <li><strong>status</strong> changed from <em>new</em> to <em>closed</em> </li> <li><strong>resolution</strong> set to <em>fixed</em> </li> </ul> <p> Found two security holes, both only in READ access (not write). Tickets raised for holes: <a class="closed ticket" href="http://localhost/ticket/132" title="defect: Security hole - read package/group list (REST) (closed: fixed)">ticket:132</a> - REST listing packages &amp; groups <a class="closed ticket" href="http://localhost/ticket/133" title="defect: Security hole - search package/group (WUI &amp; REST) (closed: fixed)">ticket:133</a> - search package/group (WUI &amp; REST) </p> <p> Full details of files checked: $ find . -name "*.py" | xargs grep "import ckan.model" ./ckan/presentation.py:import ckan.model as model REMOVED - unused ./ckan/tests/functional/test_group_edit_authz.py:import ckan.model as model - not runtime ./ckan/tests/functional/test_rest.py:import ckan.model as model - not runtime ./ckan/tests/functional/test_package.py:import ckan.model as model - not runtime ./ckan/tests/functional/test_user.py:import ckan.model as model - not runtime ./ckan/tests/functional/test_tag.py:import ckan.model as model - not runtime ./ckan/tests/functional/test_group.py:import ckan.model as model - not runtime ./ckan/tests/functional/test_package_edit_authz.py:import ckan.model as model - not runtime ./ckan/tests/functional/test_revision.py:import ckan.model as model - not runtime ./ckan/tests/functional/test_authz.py:import ckan.model as model - not runtime ./ckan/tests/test_search.py:import ckan.model as model - not runtime ./ckan/tests/models/test_package.py:import ckan.model as model - not runtime ./ckan/tests/models/test_user.py:import ckan.model as model - not runtime ./ckan/tests/models/test_group.py:import ckan.model as model - not runtime ./ckan/tests/models/test_extras.py:import ckan.model as model - not runtime ./ckan/tests/models/test_misc.py:import ckan.model as model - not runtime ./ckan/tests/models/test_authz.py:import ckan.model as model - not runtime ./ckan/tests/forms/test_package.py:import ckan.model as model - not runtime ./ckan/tests/forms/test_group.py:import ckan.model as model - not runtime ./ckan/tests/forms/test_authz.py:import ckan.model as model - not runtime ./ckan/tests/test_converter.py:import ckan.model as model - not runtime ./ckan/tests/getdata/test_data4nr.py:import ckan.model as model - not runtime ./ckan/tests/<span class="underline">init__.py:import ckan.model as model - not runtime ./ckan/tests/test_authz.py:import ckan.model as model - not runtime ./ckan/tests/test_purge_revision.py:import ckan.model as model - not runtime ./ckan/forms/common.py:import ckan.model as model - just validator ./ckan/forms/package.py:import ckan.model as model - validator &amp; package edits ./ckan/forms/group.py:import ckan.model as model - validate &amp; package, wui &amp; rest edits ./ckan/forms/authz.py:import ckan.model as model - package &amp; group wui/rest ./ckan/controllers/rest.py:import ckan.model as model - HOLE <a class="closed ticket" href="http://localhost/ticket/132" title="defect: Security hole - read package/group list (REST) (closed: fixed)">ticket:132</a> - REST listing packages &amp; groups ./ckan/controllers/base.py:import ckan.model as model - paginate filters out deleted ones ./ckan/migration/versions/005_add_authorization_tables.py:import ckan.model as model - not runtime ./ckan/getdata/data4nr.py:import ckan.model as model - not runtime ./ckan/lib/search.py:import ckan.model as model - HOLE <a class="closed ticket" href="http://localhost/ticket/133" title="defect: Security hole - search package/group (WUI &amp; REST) (closed: fixed)">ticket:133</a> - search package/group (WUI &amp; REST) ./ckan/lib/cli.py: import ckan.model as model - not runtime ./ckan/lib/cli.py: import ckan.model as model - not runtime ./ckan/lib/cli.py: import ckan.model as model - not runtime ./ckan/lib/cli.py: import ckan.model as model - not runtime ./ckan/lib/cli.py: import ckan.model as model - not runtime ./ckan/lib/cli.py: import ckan.model as model - not runtime ./ckan/lib/cli.py: import ckan.model as model - not runtime ./ckan/lib/converter.py:import ckan.model - dumper, not runtime ./ckan/lib/base.py:import ckan.model as model - just a remove ./ckan/authz.py:import ckan.model as model - only gets roles ./bin/ckan_spam.py:import ckan.models as model - not runtime ./bin/ckan-correct.py:import ckan.models - not runtime ./test_migrate.py:import ckan.model as model - not runtime </span></p> Ticket