TPS
/
ORIENT
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Prevent privilege escalation from crafted requests 

Follow up to 2046efb51d.
The previous commit prevented users from visually managing permissions that they themselves didn't have access to, this follow-up commit enforces that limitation serverside to defend against crafted privilege escalation attacks by authenticated users.
This commit is contained in:
Luke Towers 2017-07-10 18:36:43 -06:00 committed by GitHub
parent 89d0d29b69
commit 950c341c49
1 changed files with 21 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
modules/backend/formwidgets/PermissionEditor.php
View File

@ -55,11 +55,29 @@ class PermissionEditor extends FormWidgetBase
*/
public function getSaveValue($value)
{
if (is_array($value)) {
return $value;
$newPermissions = is_array($value) ? array_map('intval', $value) : [];
if (!empty($newPermissions)) {
$existingPermissions = $this->model->permissions;
$allowedPermissions = array_map(function ($permissionObject) {
return $permissionObject->code;
}, array_flatten($this->getFilteredPermissions()));
foreach ($newPermissions as $permission => $code) {
if ($code === 0) {
continue;
}
if (in_array($permission, $allowedPermissions)) {
$existingPermissions[$permission] = $code;
}
}
$newPermissions = $existingPermissions;
}
return [];
return $newPermissions;
}
/**