Can edit profile fields of other users [#559630]

With profile role enabled, going to a link of type

/user/%uid/edit gets acccess denied (%uid is any uid other than the current user)

but

/user/%uid/edit/%category-name gets me a page where i can then edit the profile of another user (%category-name is what it sounds like it is)

thus any user can edit any other users profile.

Comment	File	Size	Author
#5	559630-user-edit-access.patch	662 bytes	boombatower

Comments

Comment #1

sinasquax commented 9 November 2009 at 18:02

maybe it's the line 63 :

return user_edit_access($GLOBAL['user']);

which must be :

return user_edit_access($user);

Because user_edit_access will always return TRUE with $GLOBALS['user'] passed as $account parameter (return (($GLOBALS['user']->uid == $account->uid) || user_access('administer users')) && $account->uid > 0;)

But i don't have tested that !

Comment #2

alioso commented 13 November 2009 at 01:05

That worked and fixed the problem.
This needs to be committed in the next release. This is a pretty big security issue. Good find. Thanks!

Comment #3

clearbrook commented 20 November 2009 at 17:56

I'll patch as I load or won't load at all. I'd like to think this should not be advertised unless fixed already. I intend to use this to deal with spammers who are sometimes hackers as well. So this could lead to more mahem than it solves.

Comment #4

colin49 commented 7 January 2010 at 22:15

I came across this security bug as well and can verify that sinasquax solution fixes the issue. Hopefully the maintainer will roll that fix into a new release asap.