The default autocomplete widget may be populated through a View object: since there is no access check before running the View display, the user might end up getting a list of users or content she might not be allowed to see.
Quoting the answer from the security team:
Hello Francesco,
thanks for contacting the Drupal security team.After careful review, this vulnerability can be fixed publicly as per http://drupal.org/security-advisory-policy because it affects a branch (or branches) of a project that does not have a "stable release"
Please file a critical bug report against http://drupal.org/node/add/project-issue/references?tags=Security%20impr... in the public issue queue. You can mention that the Drupal security team has cleared this issue to be fixed publicly.
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | references-1341148-4.patch | 651 bytes | plach |
| #1 | references-1341148-1.patch | 614 bytes | plach |
Comments
Comment #1
plachIMO the correct solution should be calling
$view->access()with the current display and return an empty result if the user has no access to it.Comment #3
plachI found out this issue while trying to implement the following use case: I have a user reference widget that can be used either by anonymous users, in which case they must know the username of the user to be referred, or by authenticated users which have access to the view that provides the potential references. After applying the patch above, I discovered that this cannot be implemented anyway since the posted value must match the potential references, which in the case of an anonymous user is an empty set. Could this deserve a dedicated feature request?
Comment #4
plachgit patch
Comment #5
yched commentedMakes sense. Committed. Thanks !
Comment #6.0
(not verified) commentedUpdated issue summary