ofbiz-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Pierre Smits (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (OFBIZ-6207) Anyone can view any Request or Quote
Date Wed, 25 Mar 2015 01:16:52 GMT

    [ https://issues.apache.org/jira/browse/OFBIZ-6207?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14379093#comment-14379093

Pierre Smits commented on OFBIZ-6207:

Hi Forrest,

If you are going to have a patch for trunk and a patch for r13.07, please have the filenames
of the patches reflect the appropriate version. Otherwise other contributors might apply the
wrong patch to the wrong branch.

Best regards,


> Anyone can view any Request or Quote
> ------------------------------------
>                 Key: OFBIZ-6207
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-6207
>             Project: OFBiz
>          Issue Type: Bug
>          Components: specialpurpose/ecommerce
>    Affects Versions: Trunk, 13.07.01
>            Reporter: Forrest Rae
>            Priority: Critical
>              Labels: security
>         Attachments: OFBIZ-6207-second-attempt.patch, OFBIZ-6207.patch
> This is a security bug in the ecommerce application.  Anyone can view any quote or request
in the system regardless of the associated partyId.  They can do this via URL parameter manipulation.
> Reproduction:
> 1) Login to the ecommerce application as DemoCustomer.
> 2) Navigate to http://demo-stable-ofbiz.apache.org/ecommerce/control/ViewRequest?custRequestId=9000
to view your own request.
> 3) Navigate to http://demo-stable-ofbiz.apache.org/ecommerce/control/ViewRequest?custRequestId=9001
to view DemoCustAgent's request.
> 4) Navigate to http://demo-stable-ofbiz.apache.org/ecommerce/control/ViewRequest?custRequestId=9002
to view DemoCustomer2's request.
> Same goes for Quotes, although there are no quotes in the Demo data.  The attach patch
fixes this issue.
> Would like this issue back ported to release 13.07 please.

This message was sent by Atlassian JIRA

View raw message