amorfo77/sogo
1
0
Fork 0
mirror of https://github.com/inverse-inc/sogo.git synced 2026-07-15 05:14:53 +00:00
Code Issues Projects Releases Wiki Activity

oc: Check permissions on read opening a shared folder

Browse Source 
This is a security issue that allowed a user to read the number
of messages and its subjects when it does not have any permission to read.

Now the user cannot see other's folder without asking for me to the owner.
This commit is contained in:
Enrique J. Hernández Blasco
2016-02-16 14:55:21 +01:00
parent b92ca092ed
commit a9f336c69d
2 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
OpenChange/MAPIStoreContext.m
+10 -2
View File
@@ -438,8 +438,16 @@ static inline NSURL *CompleteURLFromMapistoreURI (const char *uri)
mapiStoreObjectWithSOGoObject: currentFolder
inContainer: nil];
[baseFolder setContext: self];
*folderPtr = baseFolder;
rc = MAPISTORE_SUCCESS;
if ([[userContext sogoUser] isEqual: activeUser]
|| [baseFolder subscriberCanReadMessages])
{
*folderPtr = baseFolder;
rc = MAPISTORE_SUCCESS;
}
else
rc = MAPISTORE_ERR_DENIED;
}
else if ([[userContext sogoUser] isEqual: activeUser])
rc = MAPISTORE_ERR_NOT_FOUND;