github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-08-05 01:33:27 -05:00
Code Issues 690 Packages Projects Releases 11 Wiki Activity

[PR #2426] [MERGED] fix: IDOR in task comments and broken authorization for background deletion #9975

New Issue
Closed
opened 2026-04-23 09:19:20 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-23 09:19:20 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/go-vikunja/vikunja/pull/2426
Author: @tink-bot
Created: 3/20/2026
Status: ✅ Merged
Merged: 3/20/2026
Merged by: @kolaente

Base: main ← Head: fix-idor-authorization

📝 Commits (7)

  • 4324c0f test: add failing test for task comment IDOR
  • b79f4bf fix: verify comment belongs to task in URL to prevent IDOR
  • 79492de test: add failing test for project background delete with read-only access
  • 194ad7b fix: require CanUpdate for project background deletion
  • 7cae445 fix: only enforce task_id check when TaskID is provided
  • adf99c0 refactor: rename checkProjectBackgroundWriteRights to checkProjectBackgroundWritePermissions
  • a05da55 fix: use require.Error instead of assert.Error for error assertions

📊 Changes

5 files changed (+114 additions, -4 deletions)

View changed files

📝 pkg/db/fixtures/users_projects.yml (+6 -0)
📝 pkg/models/task_comments.go (+10 -3)
📝 pkg/modules/background/handler/background.go (+27 -1)
➕ pkg/webtests/background_test.go (+48 -0)
📝 pkg/webtests/task_comment_test.go (+23 -0)

📄 Description

Fixes two broken object-level authorization vulnerabilities:

  • Task comment IDOR (GHSA-mr3j-p26x-72x4): getTaskCommentSimple loads a comment by ID without verifying it belongs to the task used for the permission check. Adds a task_id filter when TaskID is provided from URL parameters.
  • Project background deletion (GHSA-564f-wx8x-878h): RemoveProjectBackground checks CanRead instead of CanUpdate, allowing read-only users to delete backgrounds. Adds checkProjectBackgroundWritePermissions that checks CanUpdate.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/go-vikunja/vikunja/pull/2426 **Author:** [@tink-bot](https://github.com/tink-bot) **Created:** 3/20/2026 **Status:** ✅ Merged **Merged:** 3/20/2026 **Merged by:** [@kolaente](https://github.com/kolaente) **Base:** `main` ← **Head:** `fix-idor-authorization` --- ### 📝 Commits (7) - [`4324c0f`](https://github.com/go-vikunja/vikunja/commit/4324c0faa33f8ad6f89f31bf380ecda58de73b3b) test: add failing test for task comment IDOR - [`b79f4bf`](https://github.com/go-vikunja/vikunja/commit/b79f4bfcd2eb0ffef46558e8b01c3efdb489bcf9) fix: verify comment belongs to task in URL to prevent IDOR - [`79492de`](https://github.com/go-vikunja/vikunja/commit/79492deadd23685a02fa42d5c94420b96ca112cd) test: add failing test for project background delete with read-only access - [`194ad7b`](https://github.com/go-vikunja/vikunja/commit/194ad7b4c381911a54ae99606c18cc5a30cc44ea) fix: require CanUpdate for project background deletion - [`7cae445`](https://github.com/go-vikunja/vikunja/commit/7cae4451b07a3fdc145cf5a5b0ac07dbd472437f) fix: only enforce task_id check when TaskID is provided - [`adf99c0`](https://github.com/go-vikunja/vikunja/commit/adf99c098ed8caf1518adc725df00592ea5a3955) refactor: rename checkProjectBackgroundWriteRights to checkProjectBackgroundWritePermissions - [`a05da55`](https://github.com/go-vikunja/vikunja/commit/a05da55e880f6aed2da4e28577f50b0d70891b40) fix: use require.Error instead of assert.Error for error assertions ### 📊 Changes **5 files changed** (+114 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `pkg/db/fixtures/users_projects.yml` (+6 -0) 📝 `pkg/models/task_comments.go` (+10 -3) 📝 `pkg/modules/background/handler/background.go` (+27 -1) ➕ `pkg/webtests/background_test.go` (+48 -0) 📝 `pkg/webtests/task_comment_test.go` (+23 -0) </details> ### 📄 Description Fixes two broken object-level authorization vulnerabilities: - **Task comment IDOR** (GHSA-mr3j-p26x-72x4): `getTaskCommentSimple` loads a comment by ID without verifying it belongs to the task used for the permission check. Adds a `task_id` filter when `TaskID` is provided from URL parameters. - **Project background deletion** (GHSA-564f-wx8x-878h): `RemoveProjectBackground` checks `CanRead` instead of `CanUpdate`, allowing read-only users to delete backgrounds. Adds `checkProjectBackgroundWritePermissions` that checks `CanUpdate`. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-23 09:19:20 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No labels pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#9975