github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-07-16 06:42:23 -05:00
Code Issues 690 Packages Projects Releases 11 Wiki Activity

[PR #2450] [MERGED] fix: prevent attachment and link share IDOR vulnerabilities #5644

New Issue
Closed
opened 2026-04-16 13:46:57 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-16 13:46:57 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/go-vikunja/vikunja/pull/2450
Author: @tink-bot
Created: 3/23/2026
Status: ✅ Merged
Merged: 3/23/2026
Merged by: @kolaente

Base: main ← Head: fix-attachment-idor

📝 Commits (4)

  • 5240b01 test: add attachment fixture on inaccessible task for IDOR test
  • c682938 test: add IDOR test for task attachment ReadOne (GHSA-jfmm-mjcp-8wq2)
  • fe04f2b fix: prevent attachment IDOR by validating task_id in ReadOne (GHSA-jfmm-mjcp-8wq2)
  • 0e79ea1 fix: prevent link share IDOR by validating project_id in Delete and ReadOne

📊 Changes

4 files changed (+69 additions, -3 deletions)

View changed files

📝 pkg/db/fixtures/task_attachments.yml (+5 -0)
📝 pkg/models/link_sharing.go (+6 -2)
📝 pkg/models/task_attachment.go (+9 -1)
➕ pkg/webtests/task_attachment_idor_test.go (+49 -0)

📄 Description

Fixes GHSA-jfmm-mjcp-8wq2: TaskAttachment.ReadOne() queried by attachment ID only, ignoring the task ID from the URL, allowing cross-project file access and deletion. A similar IDOR existed in link share Delete and ReadOne which did not validate project_id.

The fix adds task_id validation in attachment ReadOne using NoAutoCondition(), and project_id validation in link share Delete and ReadOne.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/go-vikunja/vikunja/pull/2450 **Author:** [@tink-bot](https://github.com/tink-bot) **Created:** 3/23/2026 **Status:** ✅ Merged **Merged:** 3/23/2026 **Merged by:** [@kolaente](https://github.com/kolaente) **Base:** `main` ← **Head:** `fix-attachment-idor` --- ### 📝 Commits (4) - [`5240b01`](https://github.com/go-vikunja/vikunja/commit/5240b0106bb838b996fa7239b776282c2d663427) test: add attachment fixture on inaccessible task for IDOR test - [`c682938`](https://github.com/go-vikunja/vikunja/commit/c6829382fc696ab6474ff2059b323839e6383cd5) test: add IDOR test for task attachment ReadOne (GHSA-jfmm-mjcp-8wq2) - [`fe04f2b`](https://github.com/go-vikunja/vikunja/commit/fe04f2b5e494988a4c2455e11a13138b8088f6e4) fix: prevent attachment IDOR by validating task_id in ReadOne (GHSA-jfmm-mjcp-8wq2) - [`0e79ea1`](https://github.com/go-vikunja/vikunja/commit/0e79ea1138822e7e823ddf7d7b6d41cad1af97e1) fix: prevent link share IDOR by validating project_id in Delete and ReadOne ### 📊 Changes **4 files changed** (+69 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `pkg/db/fixtures/task_attachments.yml` (+5 -0) 📝 `pkg/models/link_sharing.go` (+6 -2) 📝 `pkg/models/task_attachment.go` (+9 -1) ➕ `pkg/webtests/task_attachment_idor_test.go` (+49 -0) </details> ### 📄 Description Fixes GHSA-jfmm-mjcp-8wq2: `TaskAttachment.ReadOne()` queried by attachment ID only, ignoring the task ID from the URL, allowing cross-project file access and deletion. A similar IDOR existed in link share `Delete` and `ReadOne` which did not validate `project_id`. The fix adds `task_id` validation in attachment `ReadOne` using `NoAutoCondition()`, and `project_id` validation in link share `Delete` and `ReadOne`. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-16 13:46:57 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#5644
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?