moinwiki/moin

Information leak: Anonymous users can guess page names of restricted wikis

sebix opened this issue · 8 comments

sebix commented

In wikis that are configured not to allow read access to unauthenticated anonymous users, these users can still find out which pages exist and which don't exist.

For existing pages, the error message is

Access Denied
You are not allowed to access this resource.

For non-existing pages, the error message is

Item not found
Item 'Home/DokumenteVonAnderenNicht' does not exist.

This was also mentioned in #791 (comment) by @ReimarBauer.

For consistency and to prevent unwanted information leaks, I propose always showing the "Access denied" when the user cannot see it as if the non-existent page existed.

UlrichB22 commented

I would recommend to change the error message in both cases to something like
"Item 'ITEMNAME' does not exist or you do not have permission".

@RogerHaase and @ThomasWaldmann, do you agree?

It will be a bit confusing if someone wants to add an item that already exists but the user does not have permission.

RogerHaase commented

Agree

sebix commented

Before I gonna touch the code and update all the translations, let's agree on a string :)

What about this?

The item '{item_name}' does not exist or you do not have permission to access it

It's a mix of the two strings currently in place.

RogerHaase commented

@sebix

I think you missed this change to the Development docs https://moin-20.readthedocs.io/en/latest/devel/development.html

install the pre-commit hook:

    pre-commit install  # pre-commit is used for code linting / auto-format

and the commit to master is hung up (and rather hidden).

If you click on the red X above and then click on Details you will see Black is complaining about some code formatting.

I think a way to fix this is to:

  1. run the "pre-commit install" command
  2. make a minor change to views.py, then try to commit
  3. Black will complain about the code format, and correct it automatically
  4. do de-stage, stage cycle
  5. commit, push
sebix commented

Thanks, pre-commit was indeed missing.

How can I get the templates translated? I followed https://moin-20.readthedocs.io/en/latest/devel/translate.html to extract, update and compile the locales, but I still see the English text instead of the translated German one.

UlrichB22 commented

Can you check the timestamps in your running environment for translations/de/LC_MESSAGES/messages.po and messages.mo? The messages.po should contain your changes and messages.mo should have a newer timestamp. The messages.mo is created by 'pybabel compile' and is read on each start of the webserver.

The line '#, fuzzy' can be deleted from translations that you have updated. I don't know if this has any impact.

sebix commented

The line '#, fuzzy' can be deleted from translations that you have updated. I don't know if this has any impact.

That did the trick! Thank you!