User can change text at send to phone form after changing html disable attribute in the browser and send a message.

CommentFileSizeAuthor
#6 user_can_change_text-2232285-6.patch4.78 KBalmaudoh
#5 user_can_change_text-2232285-5.patch3.25 KBalmaudoh
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

batje’s picture

batje CreditAttribution: batje commented
Status: Active » Postponed (maintainer needs more info)

could you describe this a bit more clearly, like a step-by-step guide?

kaido.toomingas’s picture

kaido.toomingas CreditAttribution: kaido.toomingas commented

You can do this by using chrome developer tool and changing texts. Message field is disabled only client side. I guess if this text has to be in certain form then it should not be inside a real textfield.

batje’s picture

batje CreditAttribution: batje commented

can you provide a patch for this?

kaido.toomingas’s picture

kaido.toomingas CreditAttribution: kaido.toomingas commented

Sorry not really.. I just tested the module generally and noticed.

almaudoh’s picture

almaudoh CreditAttribution: almaudoh commented
Status: Postponed (maintainer needs more info) » Needs review
Related issues: +#2290429: sms_user attachment to user object not always initialized
FileSize
user_can_change_text-2232285-5.patch3.25 KB

I have looked at this issue. It is not necessarily a security vulnerability since a user may still have other privileges to send sms containing dangerous links. I have however implemented a fix that ensures that even if the user enables the textarea and changes the link from the client side, the inputted link is ignored while the original link is still sent in the sms.

Additionally, I have implemented the following:

  • Made the "Send to phone" only visible to those with the permissions to send to phone.
  • Provided helpful messages to encourage users to register their numbers.
  • Added form redirection to the node page after message is sent.

However, this patch will not show the links properly until #2290429: sms_user attachment to user object not always initialized is fixed.

almaudoh’s picture

almaudoh CreditAttribution: almaudoh commented
FileSize
user_can_change_text-2232285-6.patch4.78 KB

Updated patch.

  • almaudoh committed afc20d2 on 7.x-1.x 
    Issue #2232285: Users can change text on sms send to phone disabled...
almaudoh’s picture

almaudoh CreditAttribution: almaudoh commented
Status: Needs review » Fixed

Committed / pushed to 7.x-1.x.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.