{"action":"created","issue":{"url":"https://api.github.com/repos/openwebwork/webwork2/issues/479","labels_url":"https://api.github.com/repos/openwebwork/webwork2/issues/479/labels{/name}","comments_url":"https://api.github.com/repos/openwebwork/webwork2/issues/479/comments","events_url":"https://api.github.com/repos/openwebwork/webwork2/issues/479/events","html_url":"https://github.com/openwebwork/webwork2/issues/479","id":42147319,"number":479,"title":"WW3 Security Issue","user":{"login":"goehle","id":1774907,"avatar_url":"https://avatars.githubusercontent.com/u/1774907?v=3","gravatar_id":"","url":"https://api.github.com/users/goehle","html_url":"https://github.com/goehle","followers_url":"https://api.github.com/users/goehle/followers","following_url":"https://api.github.com/users/goehle/following{/other_user}","gists_url":"https://api.github.com/users/goehle/gists{/gist_id}","starred_url":"https://api.github.com/users/goehle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/goehle/subscriptions","organizations_url":"https://api.github.com/users/goehle/orgs","repos_url":"https://api.github.com/users/goehle/repos","events_url":"https://api.github.com/users/goehle/events{/privacy}","received_events_url":"https://api.github.com/users/goehle/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/openwebwork/webwork2/labels/webwork3","name":"webwork3","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2014-09-07T17:42:37Z","updated_at":"2015-05-26T14:59:54Z","closed_at":null,"body":"A lot of the paths for WW3 just check the permission level of the current dancer session.  However, they don't validate the WeBWorK authentication cookie, that the user has the correct permission level in a given course or even that a user exists. \r\n\r\nFor example, log into a test course with a test professor.  In my case it was TestCourse, with \"testprof\".  Then go to `http://webwork.wcu.edu/webwork3/courses/:course/users` for a course 'different' than the course you logged in with.  You should be shown the users in that course.  This happens even if \"testprof\" is not a member of the course.  \r\n\r\nLooking at the code there are a lot of routes with this problem.  Things with \r\n```\r\n  if(session->{permission} < 10){send_error($PERMISSION_ERROR,403)}\r\n```\r\nand no other user validation code will be vulnerable.   This includes most of Users.pm.   Things with \r\n```\r\n    checkPermissions(10,session->{user});\r\n```\r\ndo check against the WeBWorK session and all routes should do something like that.  \r\n\r\n"},"comment":{"url":"https://api.github.com/repos/openwebwork/webwork2/issues/comments/105553872","html_url":"https://github.com/openwebwork/webwork2/issues/479#issuecomment-105553872","issue_url":"https://api.github.com/repos/openwebwork/webwork2/issues/479","id":105553872,"user":{"login":"pstaabp","id":879338,"avatar_url":"https://avatars.githubusercontent.com/u/879338?v=3","gravatar_id":"","url":"https://api.github.com/users/pstaabp","html_url":"https://github.com/pstaabp","followers_url":"https://api.github.com/users/pstaabp/followers","following_url":"https://api.github.com/users/pstaabp/following{/other_user}","gists_url":"https://api.github.com/users/pstaabp/gists{/gist_id}","starred_url":"https://api.github.com/users/pstaabp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pstaabp/subscriptions","organizations_url":"https://api.github.com/users/pstaabp/orgs","repos_url":"https://api.github.com/users/pstaabp/repos","events_url":"https://api.github.com/users/pstaabp/events{/privacy}","received_events_url":"https://api.github.com/users/pstaabp/received_events","type":"User","site_admin":false},"created_at":"2015-05-26T14:59:54Z","updated_at":"2015-05-26T14:59:54Z","body":"I agree that this will need a more thorough rethinking moving forward.  It doesn't check the permission level set in the course configuration, which it should do as well.  I'll fix this first and then move to a more sophisticated permission checking. "}}