Download & Extend

Remove CSRF vulnerability from comment module

Project:Drupal core
Version:7.x-dev
Component:comment.module
Category:bug report
Priority:critical
Assigned:boombatower
Status:closed (fixed)
Issue tags:Security Advisory follow-up

Issue Summary

could be offered as a link where the comment is displayed (next to the "delete edit reply" links)

Normally one has to see the content of the comment in order to approve it so one has to edit it first and then check publish and then save the comment. It would be very convenient to have an "approve" link next to the "delete edit reply" links for fast approval.

Sorry if Project and Component are not the appropriate ones.

Comments

#1

Project:User experience» Drupal core
Version:<none>» 7.x-dev
Component:usability» comment.module

This feature request is still valid in Drupal 6 beta2. To approve an individual comment you still have to click the "Edit" link, then click on the "Administration" fieldset title to open it, click the "Published" radio button, then scroll to the bottom of the page and click the "Submit" button. Phew!

So a one-click approval link would really be handy, if it's possible.

Redirecting to the comment.module issue queue. I guess this is for 7.x-dev because of the code freeze?

#2

Assigned to:Anonymous» boombatower
Status:active» needs review

After using my Drupal blog I have noticed that this is a feature that would be very useful. I searched and found this issue so I have attached a patch to it rather than starting a new issue.

This is my first patch related to the comment module. It may be a bit rough around the edges.

AttachmentSizeStatusTest resultOperations
comment_approval.patch2.25 KBIdleFailed: Invalid PHP syntax.View details

#3

Title:comment approval» Comment approval displayed on node view of comment

#4

Advised by chx to use comment_load.

AttachmentSizeStatusTest resultOperations
comment_approval.patch2.05 KBIdleFailed: Failed to apply patch.View details

#5

Status:needs review» reviewed & tested by the community

chx reviewed in IRC.

This includes a modified test to take this into account.

AttachmentSizeStatusTest resultOperations
comment_approval.patch4.78 KBIdleFailed: Failed to apply patch.View details

#6

Status:reviewed & tested by the community» fixed

Excellent patch. With tests and everything. :-)

#7

Great stuff!

+  $items['comment/approve'] = array(
+    'title' => 'Approve to comment',

sounds strange, like granting a permission to a user. Isn't it 'Approve a comment' ?

#8

Status:fixed» reviewed & tested by the community

Yes, I think I was trying to write "the."

AttachmentSizeStatusTest resultOperations
comment_approval_menu_title.patch657 bytesIdleFailed: Failed to apply patch.View details

#9

still applies with offset.

#10

Status:reviewed & tested by the community» fixed

Committed to CVS HEAD. Marking fixed ... thanks.

#11

Title:Comment approval displayed on node view of comment» Remove CSRF vulnerability from comment module
Category:feature request» bug report
Priority:normal» critical
Status:fixed» active

Sorry, this is a CSRF vulnerability. Either we need a confirm form or some sort of cron_key-like mechanism to allow this sort of one-click convenience to work without opening a security hole.

#12

Status:active» postponed (maintainer needs more info)

Not following you.

Need to be logged in with correct privileges:

<?php
$items
['comment/approve'] = array(
   
'title' => 'Approve a comment',
   
'page callback' => 'comment_approve',
   
'page arguments' => array(2),
   
'access arguments' => array('administer comments'),
   
'type' => MENU_CALLBACK,
  );
?>

And link won't even be displayed unless you can administer comments anyway as they are considered unpublished.

If anything now that I look at it should the url be 'comment/approve/%' ?

#13

Status:postponed (maintainer needs more info)» active

#12 - @see http://en.wikipedia.org/wiki/CSRF please. No actions should ever be taken through an insecure GET request.

#14

Believe I have it working, but I have to leave so post later.

#15

Status:active» needs review

This should do it.

Updated test so that it take the confirmation form into account and it passes. Had 1 fail (as it should) before.

AttachmentSizeStatusTest resultOperations
comment_approval.patch3.39 KBIdleFailed: Failed to apply patch.View details

#16

Why not use %comment instead of just %? Then you get comment_load() called automatically.

#17

Sure, never used it before. Was just adding % so that it would be consistent and wouldn't allow comment/approve to be called.

Patch includes minor change.

AttachmentSizeStatusTest resultOperations
comment_approval.patch3.43 KBIdleFailed: Failed to apply patch.View details

#18

Still applies, ping.

#19

Status:needs review» needs work

The patch looks good, except that these lines are completely unneeded, because confirm_form() has already set $form['#redirect']:

<?php
$comment = comment_load($form_state['values']['cid']);
$form_state['redirect'] = "node/$comment->nid";
?>

#20

Checked into, but that doesn't seem to be the case.

* @param $path
*   The page to go to if the user denies the action.
*   Can be either a drupal path, or an array with the keys 'path', 'query', 'fragment'.

And it never sets #redirect, as it also doesn't work if I remove the lines in question.

#21

Status:needs work» needs review

Patch still applies and ran comment test which returned all passes.

#22

Status:needs review» needs work

The last submitted patch failed testing.

#23

Status:needs work» needs review

Re-rolled, DB TNG was the cause of failed to apply.

AttachmentSizeStatusTest resultOperations
comment_approval.patch3.59 KBIdlePassed: 8996 passes, 0 fails, 0 exceptionsView details

#24

Status:needs review» needs work

"You can unpublish comment" should be "You can unpublish this comment". Otherwise this looks good - except I'd rather see us use tokenised links to avoid CRSF for one click operations rather than confirm forms. That probably needs centralising though.

#25

Status:needs work» needs review

Addressed #24.

AttachmentSizeStatusTest resultOperations
comment_approval.patch3.59 KBIdlePassed: 8993 passes, 0 fails, 0 exceptionsView details

#26

Sending for re-test.

AttachmentSizeStatusTest resultOperations
comment_approval_5.patch3.59 KBIdleFailed: 9021 passes, 3 fails, 3 exceptionsView details

#27

Why:

+  else {
+    drupal_set_message(t('The comment you are approving does not exist.'), 'error');
+    drupal_goto();
+  }

and not a 404?

Otherwise looks good.

#28

Status:needs review» needs work

The last submitted patch failed testing.

#29

@webchick rediscovered the CSRF vulnerability in #606608: Use proper menu router paths for comment/*. We should probably consolidate efforts here, but note there is a more up-to-date patch at http://drupal.org/node/606608#comment-2240294

She also pointed out that the access callback for this link is not correct (you should not be able to approve a comment that is already approved).

I also agree with @catch - it seems like the entire reason this was introduced was to have a convenient one-click approve link, so adding a confirmation form hurts that experience. We don't really need a confirmation form, just a token. Seems like we could get away without centralizing it - this isn't that common of link that people will be generating outside of a few special modules, and it's not hard for them to use the same token generation code as the comment module would use (and they'd learn to do that pretty quickly, since if they didn't, their links wouldn't work :)

#30

Tagging this as a known security issue.

#31

For D7 it would be nice to have some common token-adding code in the API

a number of contrib modules (e.g. fivestar) have ahd to repeatedly implement this for D6.

#32

Here is a copy of the patch that David referenced, so we can keep everything in one place, while we refocus that issue for the performance concerns.

AttachmentSizeStatusTest resultOperations
drupal.comment-approve-csrf.patch2.69 KBIdleFAILED: [[SimpleTest]]: [MySQL] Unable to apply patch drupal.comment-approve-csrf.patch.View details

#33

Status:needs work» needs review

#34

Status:needs review» needs work

The last submitted patch, drupal.comment-approve-csrf.patch, failed testing.

#35

Status:needs work» needs review

uses drupal_valid_token, instead of a cumbersome confirmation dialog. Also adds a test assertion to verify the XSRF is fixed.

AttachmentSizeStatusTest resultOperations
66264_xsrf.patch2.06 KBIdlePASSED: [[SimpleTest]]: [MySQL] 18,707 pass(es).View details

#36

This looks RTBC except for the extra space between ! and isset().

This patch also implies that comment_approve() is not an API function but that it assumes to be called through the browser (for lack of a better word). We should verify that that is a sound assumption. I haven't looked at the surrounding code.

#37

I don't think we should create vital API functions that cannot be used as an API. It shouldn't be too difficult to separate the two into a web wrapper and base API.

#38

+++ modules/comment/comment.module 12 Mar 2010 07:14:21 -0000
@@ -992,6 +992,7 @@ function comment_links($comment, $node)
           'title' => t('approve'),
           'href' => "comment/$comment->cid/approve",
           'html' => TRUE,
+          'query' => array('token' => drupal_get_token("comment/$comment->cid/approve")),

+++ modules/comment/comment.pages.inc 12 Mar 2010 07:14:21 -0000
@@ -107,6 +107,9 @@ function comment_reply($node, $pid = NUL
function comment_approve($cid) {
+  if (! isset($_GET['token']) || !drupal_valid_token($_GET['token'], "comment/$cid/approve")) {
+    return MENU_ACCESS_DENIED;
+  }

Ideally, we'd do the following:

1) Enhance l() + url() so that the value for drupal_get_token() can be specified in $options. EDIT: Actually, it's just $options['token'] = TRUE, i.e. automatically take the $href.

2) Enhance hook_menu(), so that an item can specify 'requires token' => TRUE, which makes http://api.drupal.org/api/function/menu_execute_active_handler/7 resp. http://api.drupal.org/api/function/menu_get_item/7 take the registered path (with dynamic arguments replaced from map) and automatically checks the token against that.

143 critical left. Go review some!

#39

Ok, here's a new patch that fixed the whitespace, and also tests both sides of the token validation code.

Regarding the API function, comment_approve is documented as a menu callback only, is not called elsewhere, and is in a pages.inc file so it's not even callable from other modules.

The API function is comment_save(), which I think is adequate. If you want to add an additional comment API function, that's a separate issue from fixing the security vulnerability IMO.

AttachmentSizeStatusTest resultOperations
66264_xsrf.patch2.22 KBIdlePASSED: [[SimpleTest]]: [MySQL] 18,741 pass(es).View details

#40

sun, I was thinking the same thing concerning the url() enhancement. Do you think there's still time to do that in d7? Should it be in this patch, or a different issue? (I would also really like drupal_get_token to use HMAC).

#41

Let's just fix the sec issue here, issue has been around more than a year, no reason to delay it now.

Additional hardening sounds great for a new issue though.

Patch looks RTBC pending test bot.

#42

Status:needs review» reviewed & tested by the community

Patch looks good, and works as intended.

And for anyone who is wondering, no, comment_approve() was not anything like an API function before this patch either. Here is the part of the (current) function that you can't see from the patch file:

<?php
    drupal_set_message
(t('Comment approved.'));
   
drupal_goto('node/' . $comment->nid);
  }
  return
MENU_NOT_FOUND;
?>

That's three separate, independent ways in which this is not an API function to begin with :)

So we aren't making it any worse with this patch.

#43

I also created a followup issue for the much less serious bug with the access callback of this function reported in #29:

#748996: Access callback for comment approval does not prevent approving a comment that is already published

#44

Status:reviewed & tested by the community» fixed

Patch looks good. Thanks for the hardening tests, too.

Committed to HEAD.

#45

Do we have an issue already for the suggestion in #38, more automated security token handling?

#46

@sun: I don't remember seeing one recently.

#47

@sun, @catch - Ben proposed that as his focus for the Drupalcon Core Sprint - http://www.benjeavons.com/dcsf-core-summit-presentation

#48

#49

Status:fixed» closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.