Problem/Motivation

Related-contact PII (email/phone/address) exposed without contact view/field-access checks — IDOR-class disclosure

Steps to reproduce

src/Controller/RelationshipController.php doRows() / buildAccess()

Proposed resolution

Because view any crm contact and view any crm relationship are separate permissions, a user with only relationship-view access can enumerate emails, phone numbers, and home addresses of contacts they have no permission to view. Fix: gate each related contact with ->access('view') and render PII through the field pipeline so field-level access applies.

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork crm-3605074

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

bluegeek9 created an issue. See original summary.

bluegeek9 opened merge request !241

  • bluegeek9 committed e184df01 on 1.0.x 
    task: #3605074 Potential PII (email/phone/address) expose
bluegeek9’s picture

bluegeek9 commented
Assigned: bluegeek9 » Unassigned
Status: Active » Fixed
//www.flaticon.com/free-icons/thank-you Thank you for your contribution! Your continued support makes this project sustainable.
There are multiple ways to show appreciation for the work contributed to this project including:
  • Triage issues and adding more context to existing issues.
  • Flagging CRM as a favorite on the project page to help others discover it and show your support.
  • Review the Developer Docs for accuracy and clarity.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.