jaculabilis/danbooru
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
Files
70b82010a700c1363c85e82048fd2b4976f19436
danbooru/test/functional
History
evazion 70b82010a7 search: fix info leak when searching nested associations. 
Fix an exploit in #4553. It was possible to use nested searches to infer
the contents of private forum posts.

For example:

* https://danbooru.donmai.us/users?search[forum_posts][id]=121683&search[forum_posts][body_matches]=h*
* https://danbooru.donmai.us/users?search[forum_posts][id]=121683&search[forum_posts][body_matches]=he*
* https://danbooru.donmai.us/users?search[forum_posts][id]=121683&search[forum_posts][body_matches]=hel*
* https://danbooru.donmai.us/users?search[forum_posts][id]=121683&search[forum_posts][body_matches]=hell*
* https://danbooru.donmai.us/users?search[forum_posts][id]=121683&search[forum_posts][body_matches]=hello*

The above searches returned the user 'albert', indicating that the
private forum post with id 121683 starts with the word 'hello'.

By guessing the id of a private forum post (which can be done by
searching for gaps in the id sequence), and by guessing text within the
post (which can be done by sequentially guessing characters with
wildcard searches), one could eventually infer the full text of a
private forum post.

The fix is to make nested searches only return records that are visible
to the current user.
2020-08-18 15:21:39 -05:00
..
admin
pundit: convert users to pundit.
2020-03-20 18:03:00 -05:00
explore
popular/missed searches: fix blank views.
2020-06-16 13:09:05 -05:00
maintenance/user
user deletions: fix error when given incorrect password.
2020-04-03 23:44:23 -05:00
moderator
posts: rework post deletion to use dialog box.
2020-08-03 20:21:28 -05:00
application_controller_test.rb
api: remove legacy password_hash login method.
2020-03-25 18:48:43 -05:00
artist_commentaries_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
artist_commentary_versions_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
artist_urls_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
artist_versions_controller_test.rb
fixup-add-tests
2020-07-27 19:29:22 +00:00
artists_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
autocomplete_controller_test.rb
Add OpenSearch suggestion support.
2020-07-04 17:52:53 -05:00
bans_controller_test.rb
Merge branch 'master' into attribute-searching
2020-08-17 14:23:00 -05:00
bulk_update_requests_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
comment_votes_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
comments_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
counts_controller_test.rb
search: refactor fast_count to return nil on timeout.
2020-05-07 21:02:22 -05:00
delayed_jobs_controller_test.rb
tests: add missing controller tests.
2020-03-30 12:36:06 -05:00
dmails_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
dtext_links_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
dtext_previews_controller_test.rb
Raise error on unpermitted params.
2018-04-06 18:09:57 -07:00
emails_controller_test.rb
tests: fix broken tests.
2020-08-05 12:41:48 -05:00
favorite_groups_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
favorites_controller_test.rb
tests: add more controller tests.
2020-03-31 19:00:32 -05:00
forum_post_votes_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
forum_posts_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
forum_topic_visits_controller_test.rb
tests: add missing controller tests.
2020-03-30 12:36:06 -05:00
forum_topics_controller_test.rb
Fix issue with test since Mod topics aren't visible to anonymous
2020-07-27 19:29:22 +00:00
ip_addresses_controller_test.rb
ip addresses: fix exception on ip_addresses/show page.
2020-08-18 11:16:26 -05:00
ip_bans_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
iqdb_queries_controller_test.rb
iqdb: switch to Danbooru::Http.
2020-06-14 01:06:51 -05:00
mock_services_controller_test.rb
scripts: refactor mocked services.
2020-06-21 15:11:56 -05:00
mod_actions_controller_test.rb
tests: fix test failures in #4553.
2020-08-17 15:19:34 -05:00
moderation_reports_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
modqueue_controller_test.rb
Fix #4568: Send appealed posts back to the mod queue
2020-08-06 20:55:45 -05:00
news_updates_controller_test.rb
models: remove belongs_to_creator macro.
2020-01-21 00:09:38 -06:00
note_previews_controller_test.rb
Raise error on unpermitted params.
2018-04-06 18:09:57 -07:00
note_versions_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
notes_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
password_resets_controller_test.rb
password resets: fix exception when given user does not exist.
2020-03-31 21:57:34 -05:00
passwords_controller_test.rb
users: refactor login and authentication logic.
2020-03-25 18:48:43 -05:00
pixiv_ugoira_frame_data_controller_test.rb
tests: add missing controller tests.
2020-03-30 12:36:06 -05:00
pool_elements_controller_test.rb
tests: eliminate as_user helper.
2020-06-11 01:02:01 -05:00
pool_orders_controller_test.rb
Fix exception in /pools/:id/order/edit.
2019-08-25 21:06:16 -05:00
pool_versions_controller_test.rb
tests: fix unit tests.
2020-03-21 21:07:35 -05:00
pools_controller_test.rb
seo: increase sitemap coverage.
2020-07-10 00:18:30 -05:00
post_appeals_controller_test.rb
tests: fix test failures in #4553.
2020-08-17 15:19:34 -05:00
post_approvals_controller_test.rb
Merge branch 'master' into attribute-searching
2020-08-17 14:23:00 -05:00
post_disapprovals_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
post_events_controller_test.rb
flags/appeals: replace is_resolved flag with statuses.
2020-08-07 19:24:57 -05:00
post_flags_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
post_replacements_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
post_versions_controller_test.rb
Fix the tag matches option
2020-06-23 06:58:03 +00:00
post_votes_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
posts_controller_test.rb
posts: show only last successful flag on deleted posts.
2020-08-16 17:19:29 -05:00
recommended_posts_controller_test.rb
tests: eliminate as_user helper.
2020-06-11 01:02:01 -05:00
related_tags_controller_test.rb
related tags: fix exception on copyright tags with nonexistent wiki pages.
2019-10-15 00:19:43 -05:00
robots_controller_test.rb
tests: add missing controller tests.
2020-03-30 12:36:06 -05:00
saved_searches_controller_test.rb
tests: fix saved search index action test.
2020-06-15 16:45:37 -05:00
sessions_controller_test.rb
ip bans: rename ban types to full and partial.
2020-04-07 14:59:46 -05:00
sources_controller_test.rb
skip additional tests failures that are caused by networking issues
2018-09-11 13:43:34 -07:00
static_controller_test.rb
seo: increase sitemap coverage.
2020-07-10 00:18:30 -05:00
tag_aliases_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
tag_implications_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
tags_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
uploads_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
user_feedbacks_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
user_name_change_requests_controller_test.rb
pundit: convert user name change requests to pundit.
2020-03-20 18:03:00 -05:00
user_upgrades_controller_test.rb
pundit: convert users to pundit.
2020-03-20 18:03:00 -05:00
users_controller_test.rb
search: fix info leak when searching nested associations.
2020-08-18 15:21:39 -05:00
wiki_page_versions_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00
wiki_pages_controller_test.rb
Add tests for all models with includes searches
2020-07-27 19:29:22 +00:00