Download & Extend
Issues

access bypass for files attached to restricted nodes

Posted by pwolanin on October 10, 2008 at 12:54am
Project:Drupal core
Version:7.x-dev
Component:upload.module
Category:bug report
Priority:critical
Assigned:Unassigned
Status:closed (fixed)

Issue Summary

In the Drupal 6 version, the check against Node Access was dropped in the implementation of hook_file_download.
That's a problem. Provided a user can 'view uploaded files' (has that permission), he can download any file attached to any node, including the files attached to nodes that are unpublished or to which he has no 'view' access, provided of course that he has the links to these files.

D6 and D7 patches were from Damien Tournoud. The D6 version went into 6.4 as part of the security patch.

however, slightly different fixes proposed at: http://drupal.org/node/247095

Login or register to post comments

Comments

#1

Posted by pwolanin on October 10, 2008 at 1:23am
Status:active» needs review

here's the 6.4 diff for upload module:
http://cvs.drupal.org/viewvc.py/drupal/drupal/modules/upload/upload.modu...

attached patch syncs 7.x with 6.x for function upload_file_download($filepath)

AttachmentSizeStatusTest resultOperations
upload_file_download-319341-1.patch1.34 KBIgnored: Check issue status.NoneNone

#2

Posted by pwolanin on October 10, 2008 at 1:26am

however:

The way that the node_access('view', $node)-check was added to upload_file_download broke a feature that previously was possible using the {upload}-table: to have the same file attached to multiple nodes. The bug only appears if these nodes are under different access control, and probabily only if the {upload}-table has been modified by another mdule than Upload module itself.

see: http://drupal.org/node/295586

maybe that should continue to be a feature request after the basic security hole is patched.

#3

Posted by webchick on October 11, 2008 at 3:04am
Status:needs review» fixed

Committed. Thanks!

#4

Posted by Anonymous (not verified) on October 25, 2008 at 3:24am
Status:fixed» closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.