Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

There was a problem

You must be a member of this account.

AASM, Stateful, any user can delete any other?

#21

Hi Guys,

Creating the user and sessions with stateful or aasm generates a potentially unsafe default configuration. It allows any user that can login to destroy any other user by using the :purge route. You need to be a bit creative with curl, but I've just managed to do so in my own setup.

In the User model it is mentioned that there is no page for update and delete, but with stateful and aasm there is. That might not be noticed by a regular developer. I wonder if any sites are affected.

The obvious solution is to not include the purge route, but that does not solve the problem completely. The absence of an admin user and a check for it also exposes the suspend, unsuspend and delete actions.

Kind regards,

Sander

Reported by Sander · October 7th, 2008 @ 06:23 PM

State: new
Milestone: none
Assigned to: mrflip mrflip

Activity

  1. mrflip
    mrflip
    • Tag changed from aasm, acts_as_state_machine, bug, routing, security, stateful to aasm, acts_as_state_machine, bug, routing, security, stateful

    You are right. At the very least we should add a comment instructing the user to access-control protect those routes. (The rest-auth plugin is mostly authorization scheme agnostic apart from providing the 'access denied' access control hook)

    I can certainly add a comment with some exclamation points and capital letters as soon as I make time to do some gardening, or we will happily apply a patch.

    October 9th, 2008 @ 06:57 AM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.