fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #2467 from marcoAntonioNina/BUG-14986

Browse Source 
BUG-14986 Authorization Bypass via Forceful Browsing IMPROVEMENT
This commit is contained in:
julceslauhub
2014-06-24 14:19:32 -04:00
parent 6ef94d6cb2 2cdd7c1a02
commit c6f926ef83
11 changed files with 32 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
workflow/engine/controllers/admin.php
View File

@@ -15,6 +15,8 @@ class Admin extends Controller
public function system ()
{
global $RBAC;
$RBAC->requirePermissions( 'PM_SETUP' );
require_once PATH_CONTROLLERS . 'main.php';
G::loadClass( 'system' );
$skinsList = System::getSkingList();
@@ -60,6 +62,8 @@ class Admin extends Controller
public function uxList ()
{
global $RBAC;
$RBAC->requirePermissions( 'PM_SETUP' );
require_once PATH_CONTROLLERS . 'adminProxy.php';
$this->includeExtJS( 'admin/uxUsersList' );
G::LoadClass( 'configuration' );

6
workflow/engine/controllers/dashboard.php
View File

@@ -16,6 +16,12 @@ class Dashboard extends Controller
// Class constructor
public function __construct ()
{
global $RBAC;
if ($RBAC->userCanAccess('PM_DASHBOARD') != 1) {
G::SendTemporalMessage('ID_USER_HAVENT_RIGHTS_PAGE', 'error', 'labels');
G::header( 'location: login/login' );
exit(0);
}
G::LoadClass( 'pmDashlet' );
$this->pmDashlet = new PMDashlet();
}

2
workflow/engine/methods/cases/cases_Scheduler_Log.php
View File

@@ -22,9 +22,11 @@
* For more information, contact Colosa Inc, 2566 Le Jeune Rd.,
* Coral Gables, FL, 33134, USA, or email info@colosa.com.
*/
global $RBAC;
if (($RBAC_Response = $RBAC->userCanAccess( "PM_LOGIN" )) != 1) {
return $RBAC_Response;
}
$RBAC->requirePermissions( 'PM_SETUP' );
$G_PUBLISH = new Publisher();
G::LoadClass( 'configuration' );

2
workflow/engine/methods/processes/mainInit.php
View File

@@ -23,6 +23,8 @@
*/
//$oHeadPublisher = & headPublisher::getSingleton();
global $RBAC;
$RBAC->requirePermissions( 'PM_FACTORY' );
G::loadClass( 'configuration' );
$conf = new Configurations();

2
workflow/engine/methods/setup/appCacheViewConf.php
View File

@@ -1,4 +1,6 @@
<?php
global $RBAC;
$RBAC->requirePermissions( 'PM_SETUP' );
// header('Pragma: no-cache');
// header('Cache-Control: no-store, no-cache, must-revalidate');

2
workflow/engine/methods/setup/clearCompiled.php
View File

@@ -21,6 +21,8 @@
* For more information, contact Colosa Inc, 2566 Le Jeune Rd.,
* Coral Gables, FL, 33134, USA, or email info@colosa.com.
*/
global $RBAC;
$RBAC->requirePermissions( 'PM_SETUP' );
$oHeadPublisher = & headPublisher::getSingleton();
$oHeadPublisher->addExtJsScript( 'setup/clearCompiled', true ); //adding a javascript file .js

3
workflow/engine/methods/setup/environmentSettings.php
View File

@@ -1,4 +1,7 @@
<?php
global $RBAC;
$RBAC->requirePermissions( 'PM_SETUP' );
G::loadClass( 'configuration' );
$c = new Configurations();
$oHeadPublisher = & headPublisher::getSingleton();

3
workflow/engine/methods/setup/loginSettings.php
View File

@@ -21,6 +21,9 @@
* For more information, contact Colosa Inc, 2566 Le Jeune Rd.,
* Coral Gables, FL, 33134, USA, or email info@colosa.com.
*/
global $RBAC;
$RBAC->requirePermissions( 'PM_SETUP' );
G::loadClass( 'configuration' );
$oConf = new Configurations();

2
workflow/engine/methods/setup/pluginsMain.php
View File

@@ -21,6 +21,8 @@
* For more information, contact Colosa Inc, 2566 Le Jeune Rd.,
* Coral Gables, FL, 33134, USA, or email info@colosa.com.
*/
global $RBAC;
$RBAC->requirePermissions( 'PM_SETUP' );
$headPublisher = & headPublisher::getSingleton();
$headPublisher->addExtJsScript( 'setup/pluginsMain', false );

3
workflow/engine/methods/setup/processHeartBeatConfig.php
View File

@@ -21,6 +21,9 @@
* For more information, contact Colosa Inc, 2566 Le Jeune Rd.,
* Coral Gables, FL, 33134, USA, or email info@colosa.com.
*/
global $RBAC;
$RBAC->requirePermissions( 'PM_SETUP' );
$oHeadPublisher = & headPublisher::getSingleton();
G::LoadClass( 'serverConfiguration' );
$oServerConf = & serverConf::getSingleton();

3
workflow/engine/methods/setup/systemInfo.php
View File

@@ -1,4 +1,7 @@
<?php
global $RBAC;
$RBAC->requirePermissions( 'PM_SETUP' );
$option = (isset($_GET["option"]))? $_GET["option"] : null;
switch ($option) {