| Description | MantisBT permits an authenticated user to upload an attachment to a private issue they are not authorized to view.
- The flaw is in the authorization model for existing-issue uploads. The REST endpoint POST /api/rest/issues/{id}/files reaches
IssueFileAddCommand.php:134, which delegates permission checking to file_allow_bug_upload():1147.
- For existing issues, that function authorizes based on project-level upload permission only, not issue-level visibility. As a result, a user who meets
upload_bug_file_threshold for the project can upload to a private issue even when view_bug_threshold denies access to that issue.
Affected Components
- REST route: issues_rest.php:244
- Command handler: IssueFileAddCommand.php:134
- Permission check: file_api.php:1147
Root Cause
For existing issues, file_allow_bug_upload() evaluates:
return access_has_project_level(
config_get( 'upload_bug_file_threshold' ),
$t_project_id,
$p_user_id
);
This does not enforce private-issue access controls. The authorization decision should be tied to the target issue, not just the project. |
|---|
| Additional Information | Patch
diff --git a/core/file_api.php b/core/file_api.php
index 2ec84ef..FIXME 100644
--- a/core/file_api.php
+++ b/core/file_api.php
@@ -1161,7 +1161,11 @@ function file_allow_bug_upload( $p_bug_id = null, $p_user_id = null, $p_project_
return true;
}
- # Check the access level against the config setting
- return access_has_project_level( config_get( 'upload_bug_file_threshold' ), $t_project_id, $p_user_id );
+ # For existing issues, enforce issue-level access so private / restricted
+ # issues cannot be modified by users who only meet the project threshold.
+ if( $p_bug_id !== null ) {
+ return access_has_bug_level( config_get( 'upload_bug_file_threshold' ), $p_bug_id, $p_user_id );
+ }
+
+ return access_has_project_level( config_get( 'upload_bug_file_threshold' ), $t_project_id, $p_user_id );
}
Clean Final Code
function file_allow_bug_upload( $p_bug_id = null, $p_user_id = null, $p_project_id = null ) {
if( null === $p_user_id ) {
$p_user_id = auth_get_current_user_id();
}
# If uploads are disabled just return false
if( !file_is_uploading_enabled() ) {
return false;
}
if( null === $p_bug_id ) {
# new bug
$t_project_id = $p_project_id === null ? helper_get_current_project() : $p_project_id;
# the user must be the reporter if they're reporting a new bug
$t_reporter = true;
} else {
# existing bug
$t_project_id = bug_get_field( $p_bug_id, 'project_id' );
# check if the user is the reporter of the bug
$t_reporter = bug_is_user_reporter( $p_bug_id, $p_user_id );
}
if( $t_reporter && ( ON == config_get( 'allow_reporter_upload' ) ) ) {
return true;
}
if( $p_bug_id !== null ) {
return access_has_bug_level(
config_get( 'upload_bug_file_threshold' ),
$p_bug_id,
$p_user_id
);
}
return access_has_project_level(
config_get( 'upload_bug_file_threshold' ),
$t_project_id,
$p_user_id
);
}
In short:
- new issue upload:
access_has_project_level(upload_bug_file_threshold, project_id, user_id)
uploading to a new issue in a project still works if the user has project upload permission
- existing issue upload:
access_has_bug_level(upload_bug_file_threshold, bug_id, user_id)
uploading to an existing private issue now correctly requires issue-level access and is denied
|
|---|
