mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-23 03:53:21 +00:00
ignacionelson
305c79bc96
Reported by @hackchang (GHSA-c6h9-hcm7-j3x9). GHSA-r3hg-3fxw-rcmr scoped the group controllers; invitations were written afterwards and were not, so the same reach was open through a different door. A client-scoped staff member with `create_clients` could read every group's id and name off the invitation form, name any of them on an invitation, and have the invited client added to it at redemption — a group whose files they cannot see and whose members are not theirs. The ordinary way to do that, adding a member to a group, refuses on StaffLibraryScope::allowsGroupMembership(); the invitation path never asked. Three places, because the hole had three halves: - the form lists `$this->scope->groups($viewer)`, as GroupsController already does; - the request is validated against those groups rather than every group there is, since a request need not come from the form; - redemption asks allowsGroupMembership() of the invitation's sender before writing the membership. The last one is the one that matters. An invitation is a grant that lands days later, when the sender is not present to be checked, and the ones written before today are still outstanding. A refused membership is dropped and logged rather than failing the redemption: the account is what the person holding the link came for, and it is theirs either way. An invitation whose sender has since been deleted keeps its group — there is no longer a reach to exceed.