Comments (4)
Would love to receive an example of parameters that can be used for an attack, and possibly a patch to merge.
Thank you!
from redmine_watcher_groups.
In WatcherGroupsController#create
, ["watcher_group"]["group_ids"]
is not sanitized before being passed to the raw SQL string, so passing on ; something
as ["watcher_group"]["group_ids"]
to WatcherGroupsController#create
will result in:
(0.2ms) INSERT INTO `watchers` (`user_id`, `watchable_id`, `watchable_type`) VALUES (; something, 9, 'Issue')
Mysql2::Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '; something, 9, 'Issue')' at line 1:
INSERT INTO `watchers` (`user_id`, `watchable_id`, `watchable_type`) VALUES (; something, 9, 'Issue')
This will obviously only crash the request, as you can pass arbitrary SQL to the database though this basically would allow an attacker to completely take over the Redmine data.
from redmine_watcher_groups.
See #10 for a minimal fix.
from redmine_watcher_groups.
Fixed on my branch, please look at https://github.com/maxrossello/redmine_watcher_groups.
Thank you
from redmine_watcher_groups.
Related Issues (14)
- Tickets can no longer be opened after installation HOT 3
- Redmine issue details “page not found” after update HOT 2
- not support redmine 3.2.1 & 3.3.0 HOT 3
- Issue details not showing after watcher_groups install
- Please tell me the license HOT 2
- Compatibility for 4.0.7.stable
- Not compatible with Redmine 4.1.1
- Translation missing. en.label_group_search HOT 1
- Global groups in the list HOT 2
- Watcher groups during creating a new issue HOT 2
- Watcher groups not working on redmine 2.3.1 due to threading issue passenger
- Plugin is mySQL only. Not working at our university (postgress) HOT 1
- Can't add watcher group after issue creation
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from redmine_watcher_groups.