Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Calendar widget: Cache contents using user ID as well #521

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from

Conversation

zosterops-lateralis
Copy link

Hello,

Thank you for the work on developing this plugin!

I've stumbled upon a slight security issue in the calendar widget, which might leak a user's private events.

In order to reproduce:

  1. Ensure you have the calendar widget somewhere on your site.
  2. Create a new user (say test) without the read_private_events capacity.
  3. Create a new private event and assign it to this user.
  4. Log out and log in as this user.
  5. Consult the calendar widget on your site and ensure you can see this user's private event. (Otherwise, clear the caches so that EO refreshes the widget contents.)
  6. Log out.
  7. Consult the calendar widget on your site: the new user's private event should still show up.

The expected behavior is that the private event shouldn't be displayed here: only test and users with the read_private_events should be able to see it.

It seems to me that this is because the caching mechanism for the calendar widget is a bit too lax: even when read_private_events isn't set for the current user, the calendar widget will still show their private events (which is expected), but they will then be cached for any user who doesn't have the read_private_events capacity.

This tiny PR intends to fix this by using the current user's ID in the caching key instead of the read_private_events capacity. (Also, since the _priv key in the $args array then becomes useless, it is removed.)

From the tests I could run, this was enough to fix the issue.

Thanks!

Zosterops

Even when `read_private_events` isn't set for the current user,
using only this key for caching might write the current user's
private events into the cache for other users.

The `_priv` key in the `$args` array then becomes useless and
can be removed entirely.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant