From a9f336c69d3314dbd92ba686423c3973d4afd0f1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Enrique=20J=2E=20Hern=C3=A1ndez=20Blasco?= Date: Thu, 4 Feb 2016 11:31:00 +0100 Subject: [PATCH] oc: Check permissions on read opening a shared folder This is a security issue that allowed a user to read the number of messages and its subjects when it does not have any permission to read. Now the user cannot see other's folder without asking for me to the owner. --- OpenChange/MAPIStoreContext.m | 12 ++++++++++-- OpenChange/MAPIStoreSOGo.m | 5 +++++ 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/OpenChange/MAPIStoreContext.m b/OpenChange/MAPIStoreContext.m index 4aee98acf..32a01e147 100644 --- a/OpenChange/MAPIStoreContext.m +++ b/OpenChange/MAPIStoreContext.m @@ -438,8 +438,16 @@ static inline NSURL *CompleteURLFromMapistoreURI (const char *uri) mapiStoreObjectWithSOGoObject: currentFolder inContainer: nil]; [baseFolder setContext: self]; - *folderPtr = baseFolder; - rc = MAPISTORE_SUCCESS; + + if ([[userContext sogoUser] isEqual: activeUser] + || [baseFolder subscriberCanReadMessages]) + { + *folderPtr = baseFolder; + rc = MAPISTORE_SUCCESS; + } + else + rc = MAPISTORE_ERR_DENIED; + } else if ([[userContext sogoUser] isEqual: activeUser]) rc = MAPISTORE_ERR_NOT_FOUND; diff --git a/OpenChange/MAPIStoreSOGo.m b/OpenChange/MAPIStoreSOGo.m index 41c8bf42a..604482ee7 100644 --- a/OpenChange/MAPIStoreSOGo.m +++ b/OpenChange/MAPIStoreSOGo.m @@ -244,8 +244,13 @@ static void mapiapp_cleanup(void) \details Create a connection context to the sogo backend \param mem_ctx pointer to the memory context + \param conn_info pointer to the connection information available for this context + (database connection, connected user, replica server info) + \param indexing pointer to the indexing database connection \param uri pointer to the sogo path \param private_data pointer to the private backend context + + \note the developer must free allocated private_data */ static enum mapistore_error