N°8606 - Check user permissions in search operation of ajax.render.php#836
N°8606 - Check user permissions in search operation of ajax.render.php#836Lenaick wants to merge 1 commit intosupport/3.2from
Conversation
Lenaick
force-pushed
the
issue/8606-unauthorized-access-to-object
branch
from
c4d74c4 to
2b6fee3
Compare
There was a problem hiding this comment.
Pull request overview
This PR fixes a security vulnerability (N°8606) where users could access unauthorized objects via the search operation in ajax.render.php. The fix adds permission checks using UserRights::IsActionAllowed() in the GetDataForTable method before returning object data.
Changes:
- Adds a
UserRightsimport and twoUR_ACTION_READpermission checks inAjaxRenderController::GetDataForTable()— one for the main query class and one for each alias class in join queries — throwing an exception with a localized error message if the user lacks read access.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| // N°8606 : Check user permissions on the current class | ||
| if (UserRights::IsActionAllowed($sClass, UR_ACTION_READ, $oSet) !== UR_ALLOWED_YES) { | ||
| throw new Exception(Dict::Format('UI:Error:ReadNotAllowedOn_Class', $sClass)); | ||
| } |
There was a problem hiding this comment.
The permission check for alias classes is placed inside the while ($aObject = $oSet->FetchAssoc()) loop, meaning UserRights::IsActionAllowed is called once per row per alias. Since the check is class-based (not object-based), the result is the same on every iteration. While GetUserActionGrant has internal caching that reduces the cost, this check should be moved before the while loop (alongside the main class check at line 77) for clarity and to avoid unnecessary function call overhead on every row. You could iterate over $aClassAliases before the loop and check each class once.
Base information
Symptom
Users can access unauthorized objects via the search operation in
ajax.render.phpCause
User permissions are not checked before returning object
Proposed solution
Add a permission check before returning objects
Checklist before requesting a review