Missing access_control on theme configuration [#221072]

I just found a really ugly security bug:
The theme configuration pages (e.g. admin/build/themes/settings/garland) are not secured at all against anonymous users.

The enclosed patch introduces the necessary access check (user_access('administer site configuration')) into _system_themes_access.

To reproduce: Just log off your site and go to admin/build/themes/settings/garland. The page will be displayed, as if you had admin rights.

The enclosed patch was created against D6, but does also cleanly apply to HEAD (D7). D5 is not affected by this bug.

File	Size	Author
access_control_themes_settings.jpg	39.62 KB	Pancho
access_control_themes_settings.patch	718 bytes	Pancho

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

chx CreditAttribution: chx commented 13 February 2008 at 05:10

Status:

Needs review

» Reviewed & tested by the community

Comment #2

jgoldberg CreditAttribution: jgoldberg commented 13 February 2008 at 06:00

Has anyone considered some kind of security mechanism that applies to any /admin/* menu item?

Comment #3

cburschka

they

CreditAttribution: cburschka commented 13 February 2008 at 09:09

Technically, D6 menus should default the access control on items to their parents. admin/build is surely secured. How does this bug occur in spite of that?

Comment #4

cburschka

they

CreditAttribution: cburschka commented 13 February 2008 at 09:13

Oh, never mind. The access only defaults to the parent if the access callback isn't set - and it is here. If you implement your own access hook, you have to take care to secure the page against unauthorized entry, so the fix in the patch is completely correct.