Suggested commit message (based on bug bounty input)

Issue #2512460 by pwolanin, Gábor Hojtsy, grisendo, JvE: "Translate user edited configuration" permission needs to be marked as restricted

Problem/Motivation

The "Translate user edited configuration" permission actually allows one to translate shipped configuration strings, which is an overlap with interface text translation. This may result in string reuse between configuration and interface which leads to these configuration translations possibly returned by t(), e.g. with translating default content type labels. The return value of t() is considered safe, so the permission to translate configuration needs to be marked restricted.

reported multiply in the Drupal 8 security bug bounty program

https://tracker.bugcrowd.com/submissions/672a7ac983d1d6e554114e2f287824a...
https://tracker.bugcrowd.com/submissions/4cab8e9ba13cfb3d4eec3348bd884b3...

Proposed resolution

The config translation permission should be clarified (the incorrect description fixed) and the interface translation one should be updated to match actual behavior. The config translation permission needs to be a restricted permission.

Remaining tasks

Review. Commit.

User interface changes

Permission names are better, descriptions are accurate. Config translation permission is restricted.

API changes

None.

Data model changes

None.

Files: 
CommentFileSizeAuthor
#7 2512460-6.patch1.1 KBGábor Hojtsy
PASSED: [[SimpleTest]]: [PHP 5.4 MySQL] 97,318 pass(es). View
#7 interdiff.txt1.1 KBGábor Hojtsy
#7 InterfaceTranslatioVSConfig.png159.93 KBGábor Hojtsy
#1 2512460-1.patch523 bytespwolanin
PASSED: [[SimpleTest]]: [PHP 5.4 MySQL] 97,322 pass(es). View

Comments

pwolanin’s picture

Issue summary: View changes
Status: Active » Needs review
FileSize
523 bytes
PASSED: [[SimpleTest]]: [PHP 5.4 MySQL] 97,322 pass(es). View

This patch came from JvE on bugcrowd

dawehner’s picture

Status: Needs review » Reviewed & tested by the community

Agreed

Gábor Hojtsy’s picture

Status: Reviewed & tested by the community » Needs work

We discussed with @pwolanin that the name of the perm also needs fixing for clarity.

Gábor Hojtsy’s picture

Assigned: Unassigned » Gábor Hojtsy
Gábor Hojtsy’s picture

Issue tags: +D8MI, +language-config, +sprint
pwolanin’s picture

Gábor Hojtsy’s picture

Issue summary: View changes
Status: Needs work » Needs review
FileSize
159.93 KB
1.1 KB
1.1 KB
PASSED: [[SimpleTest]]: [PHP 5.4 MySQL] 97,318 pass(es). View

Updated permission names and descriptions. This is the figure I drew for @pwolanin yesterday to explain the issue :)

Gábor Hojtsy’s picture

Title: "Translate user edited configuration" permission needs to be marked as sensitive » "Translate user edited configuration" permission needs to be marked as restricted
Issue summary: View changes

Fix terminology

dawehner’s picture

Status: Needs review » Reviewed & tested by the community

That is not a bad idea!

alexpott’s picture

Status: Reviewed & tested by the community » Fixed

Committed 447538d and pushed to 8.0.x. Thanks!

  • alexpott committed 8ec5874 on 8.0.x
    Issue #2512460 by pwolanin, Gábor Hojtsy, grisendo, JvE: "Translate user...
Gábor Hojtsy’s picture

Issue tags: -sprint

Superb, thanks!

xjm’s picture

Title: "Translate user edited configuration" permission needs to be marked as restricted » [change record] "Translate user edited configuration" permission needs to be marked as restricted
Status: Fixed » Active
Issue tags: +Needs change record
xjm’s picture

Assigned: Gábor Hojtsy » Unassigned
Daniel_Rose’s picture

Assigned: Unassigned » Daniel_Rose

I'd like to have a try with writing the change record. I'm a novice user looking for ways to help and get some experience. :)

Daniel_Rose’s picture

Here is the change record for review: https://www.drupal.org/node/2522770. Hopefully it looks ok.

Daniel_Rose’s picture

Assigned: Daniel_Rose » Unassigned
Status: Active » Needs review
larowlan’s picture

Status: Needs review » Fixed

Published the change record - great work daniel_rose

Daniel_Rose’s picture

Thanks for your help @larowlan

larowlan’s picture

Title: [change record] "Translate user edited configuration" permission needs to be marked as restricted » "Translate user edited configuration" permission needs to be marked as restricted
Gábor Hojtsy’s picture

Note that the security policy was updated at https://www.drupal.org/node/475848/revisions/view/7267195/8630716 as well.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.