CVE-2015-5302: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: libreport 2.0.7 before 2.6.3 only saves changes to the first file when editing a crash report, which allows remote attackers to obtain sensitive information via unspecified vectors related to the (1) backtrace, (2) cmdline, (3) environ, (4) open_fds, (5) maps, (6) smaps, (7) hostname, (8) remote, (9) ks.cfg, or (10) anaconda-tb file attachment included in a Red Hat Bugzilla bug report.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Published: 2015-12-07T18:59Z
Repository: https://github.com/abrt/libreport
Language: C
Files changed: src/gui-wizard-gtk/wizard.c
Commit date: 2015-10-12 09:34:29 +0200
Commit message: wizard: fix save users changes after reviewing dump dir files

If the user reviewed the dump dir's files during reporting the crash, the
changes was thrown away and original data was passed to the bugzilla bug
report.

report-gtk saves the first text view buffer and then reloads data from the
reported problem directory, which causes that the changes made to those text
views are thrown away.

Function save_text_if_changed(), except of saving text, also reload the files
from dump dir and update gui state from the dump dir. The commit moves the
reloading and updating gui functions away from this function.

Related to rhbz#1270235

Signed-off-by: Matej Habrnal <mhabrnal@redhat.com>

Diff: diff --git a/src/gui-wizard-gtk/wizard.c b/src/gui-wizard-gtk/wizard.c
index 55a4b58..2d8d6ba 100644
--- a/src/gui-wizard-gtk/wizard.c
+++ b/src/gui-wizard-gtk/wizard.c
@@ -431,12 +431,10 @@ static void save_text_if_changed(const char *name, const char *new_value)
         if (dd)
             dd_save_text(dd, name, new_value);
 
 //FIXME: else: what to do with still-unsaved data in the widget??
         dd_close(dd);
-        problem_data_reload_from_dump_dir();
-        update_gui_state_from_problem_data(/* don't update selected event */ 0);
     }
 }
 
 static void save_text_from_text_view(GtkTextView *tv, const char *name)
 {
@@ -775,11 +773,15 @@ static void tv_details_row_activated(
         gtk_widget_show(textview);
 
         load_text_to_text_view(GTK_TEXT_VIEW(textview), item_name);
 
         if (gtk_dialog_run(GTK_DIALOG(dialog)) == GTK_RESPONSE_OK)
+        {
             save_text_from_text_view(GTK_TEXT_VIEW(textview), item_name);
+            problem_data_reload_from_dump_dir();
+            update_gui_state_from_problem_data(/* don't update selected event */ 0);
+        }
 
         gtk_widget_destroy(textview);
         gtk_widget_destroy(scrolled);
         gtk_widget_destroy(dialog);
     }
@@ -2707,11 +2709,12 @@ static void on_page_prepare(GtkNotebook *assistant, GtkWidget *page, gpointer us
     /* Must be called before any GUI operation because the following two
      * functions causes recreating of the text items tabs, thus all updates to
      * these tabs will be lost */
     save_items_from_notepad();
     save_text_from_text_view(g_tv_comment, FILENAME_COMMENT);
-
+    problem_data_reload_from_dump_dir();
+    update_gui_state_from_problem_data(/* don't update selected event */ 0);
 
     if (pages[PAGENO_SUMMARY].page_widget == page)
     {
         if (!g_expert_mode)
         {

Vulnerable code:         problem_data_reload_from_dump_dir();
        update_gui_state_from_problem_data(/* don't update selected event */ 0);

Fixed code:         {
            problem_data_reload_from_dump_dir();
            update_gui_state_from_problem_data(/* don't update selected event */ 0);
        }
    problem_data_reload_from_dump_dir();
    update_gui_state_from_problem_data(/* don't update selected event */ 0);