Skip to content

Commit

Permalink
bug fix: pre-auth
Browse files Browse the repository at this point in the history
  • Loading branch information
@usmannasir
usmannasir committed Oct 23, 2024
1 parent fd05ec4 commit 5b08cd6
Showing 1 changed file with 10 additions and 0 deletions.
10 changes: 10 additions & 0 deletions databases/views.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -503,6 +503,16 @@ def upgrademysqlnow(request):

def upgrademysqlstatus(request):
try:

userID = request.session['userID']

currentACL = ACLManager.loadedACL(userID)

if currentACL['admin'] == 1:
pass
else:
return ACLManager.loadErrorJson('FilemanagerAdmin', 0)

data = json.loads(request.body)
statusfile = data['statusfile']
installStatus = ProcessUtilities.outputExecutioner("sudo cat " + statusfile)
Expand Down

1 comment on commit 5b08cd6

@todb-cisa
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @usmannasir! Given the reference in CVE-2024-51567, I'm assuming this commit, does, in fact, fix the permissions issue described there. The reason I bring it up is because there's no associated pull request or test or anything that explicitly calls out CVE-2024-51567, and given the reports of exploitation of this bug in the wild, I want to make sure that this isn't a partial fix and there's some other commit floating around that fully rectifies it.

Are you planning on a release note for this in a tagged branch? I see this commit exists here:

git branch -a --contains 5b08cd6
* stable
  remotes/origin/HEAD -> origin/stable
  remotes/origin/stable
  remotes/origin/v2.3.7
  remotes/origin/v2.3.8
  remotes/origin/v2.3.8-dev

Please sign in to comment.