owncloud / owncloud/ocis

Settings service user can list other peoples assignments

Open
#5,032 1 comment 0 reactions 0 assignees View on GitHub
Severity:sev4-low Topic:Security Type:Technical-Debt
Dominant language
Go
Stars
2.1k
Forks
274
Avg merge
2d 2h
Merged PRs (30d)
106

Description

## Context
oCIS version: v2.0.0-rc.1

## Issue
A normal user can list other users assignments. In this case Einstein can list the admins assignments:
```
curl -k -s -u einstein:relativity -X POST 'https://localhost:9200/api/v0/settings/assignments-list' -d '{"account_uuid":"be65710a-bced-465e-9e1a-72ff269de8ee"}' | jq .

{
"assignments": [
{
"id": "30879be8-bb6f-4248-9188-df3ef6a772f7",
"accountUuid": "be65710a-bced-465e-9e1a-72ff269de8ee",
"roleId": "71881883-1768-46bd-a24d-a356a2afdf7f"
},
{
"id": "f03dacd1-314b-4561-8654-6e729555324a",
"accountUuid": "be65710a-bced-465e-9e1a-72ff269de8ee",
"roleId": "71881883-1768-46bd-a24d-a356a2afdf7f"
},
{
"id": "98dad15a-46aa-4302-9c41-6e3d6d4f0813",
"accountUuid": "be65710a-bced-465e-9e1a-72ff269de8ee",
"roleId": "71881883-1768-46bd-a24d-a356a2afdf7f"
},
{
"id": "94a64f94-1219-46fb-b950-fd1487f453ee",
"accountUuid": "be65710a-bced-465e-9e1a-72ff269de8ee",
"roleId": "71881883-1768-46bd-a24d-a356a2afdf7f"
}
]
}
```

## Expected

I don't know right now if there are valid cases where this would make sense but intuitively I'd say that this should be prohibited.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.