Bypass access via comments [#19009]

I believe I have found a bug.
If you goto http://www.etherpunk.com/comment/reply/180 (possibly NSFW) it allows you to view the posting (while you don't have permission to actually post, it still allows the page to get displayed).
I found this out by using awstats on my box and found that a hidden page was getting hit fairly common that I really don't want getting shown (well, it's on the web, I know... but... I'd rather have more controlled access).

Does this belong in the comment section for not obeying TAC?

Can anyone confirm this on their site?

Kenny

Comment	File	Size	Author
#15	comment_reply_access_6.patch	1.87 KB	killes@www.drop.org
#15
#12	comment_reply_access_5.patch	1.65 KB	chx
#12
#11	comment_reply_access_4.patch	1.65 KB	chx
#11
#10	comment_reply_access_3.patch	1.61 KB	chx
#10
#7	comment_reply_access_2.patch	1.56 KB	chx
#7
#6	comment_reply_access_1.patch	1.56 KB	chx
#6
#4	comment_reply_access_0.patch	1.51 KB	chx
#4
#3	comment_reply_access.patch	1.36 KB	chx
#3

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

pyromanfo CreditAttribution: pyromanfo commented 16 March 2005 at 20:02

That's definitely something you need to take up with the comment module guys. It's not just taxonomy access control either, it's the core node_access hooks in Drupal. If they'll just check that before displaying a node for reply, that'd fix it no problem.

Comment #2

moshe weitzman CreditAttribution: moshe weitzman commented 16 March 2005 at 20:20

Project:	Taxonomy Access Control	» Drupal core
Component:	Code	» comment.module
Priority:	Normal	» Critical

filed under comment.module ... note that my big comment patch gets rid of this page entirely (consolidates under comment/edit) so it might make sense to apply my patch instead of fixing this.

Comment #3

chx CreditAttribution: chx commented 20 March 2005 at 02:14

Assigned:

Unassigned

» chx

File	Size
comment_reply_access.patch	1.36 KB

moshe , http://drupal.org/node/18656 this does not seem to affect the permissions of the comment/reply path.

I think the approach I have taken is blatantly simple: literally check for access.

Comment #4

chx CreditAttribution: chx commented 20 March 2005 at 02:24

File	Size
comment_reply_access_0.patch	1.51 KB

Comment #5

chx CreditAttribution: chx commented 20 March 2005 at 02:26

Comment #6

chx CreditAttribution: chx commented 20 March 2005 at 02:37

File	Size
comment_reply_access_1.patch	1.56 KB

Comment #7

chx CreditAttribution: chx commented 20 March 2005 at 02:38

File	Size
comment_reply_access_2.patch	1.56 KB

Comment #8

(not verified) CreditAttribution: commented 20 March 2005 at 08:48

The discovery of this patch makes me wonder, whether we shouldn't centralize the access controll a bit more.
If a core module can show this kind of bug, contrib modules will almost certainly. I propose to do a node_access() check inside node_load.
Gerhard

Comment #9

(not verified) CreditAttribution: commented 20 March 2005 at 09:03

I also don't think that the patch is working.
node_access(arg(2)) should probably be node_access('view', $node) and the node needs loading before.
Gerhard

Comment #10

chx CreditAttribution: chx commented 20 March 2005 at 09:28

File	Size
comment_reply_access_3.patch	1.61 KB

OK, patch corrected.

I think adding node_access to node_load would break havoc 'cos there are some routines (even in core) which do not check whether the node_load was successful or not. This is a whole another topic, please make another issue.

What we need, IMHO is to patch this quickly...