CVE-2022-35921: Incorrect Authorization (CWE-863)
value: fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of Byobu should update the extension to version 1.1.7, where this has been patched. Users of Byobu with Flarum 1.0 or 1.1 should upgrade to Flarum 1.2 or later, or evaluate the impact this issue has on your forum's users and choose to disable the extension if needed. There are no workarounds for this issue.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 4.3
Published: 2022-08-01T22:15Z
Repository: https://github.com/FriendsOfFlarum/byobu
Language: JavaScript
Files changed: js/src/forum/extend/User.js, js/src/forum/helpers/canStartPrivateDiscussion.js, js/src/forum/pages/PrivateDiscussionsUserPage.js, src/Discussion/Screener.php
Commit date: 2022-07-31 21:27:43 +0100
Commit message: fix: prevent starting a PD with users blocking them (#175)


Diff: diff --git a/js/src/forum/extend/User.js b/js/src/forum/extend/User.js
index 5efecac..9d03786 100644
--- a/js/src/forum/extend/User.js
+++ b/js/src/forum/extend/User.js
@@ -6,25 +6,21 @@ import UserControls from 'flarum/forum/utils/UserControls';
 import PrivateDiscussionComposer from './../pages/discussions/PrivateDiscussionComposer';
 import Button from 'flarum/common/components/Button';
 import ItemList from 'flarum/common/utils/ItemList';
 import UserPage from 'flarum/forum/components/UserPage';
 import LinkButton from 'flarum/common/components/LinkButton';
+import canStartPrivateDiscussion from '../helpers/canStartPrivateDiscussion';
 
 export default () => {
   attributes();
   message();
   sharedMessageHistory();
 };
 
 function message() {
   extend(UserControls, 'userControls', function (items, user) {
-    if (
-      app.session.user &&
-      app.session.user.id() !== user.id() &&
-      app.forum.attribute('canStartPrivateDiscussion') &&
-      (user.blocksPd() === false || (app.forum.attribute('canStartPrivateDiscussionWithBlockers') && user.cannotBeDirectMessaged()))
-    ) {
+    if (canStartPrivateDiscussion(user)) {
       items.add(
         'private-discussion',
         Button.component(
           {
             icon: app.forum.attribute('byobu.icon-badge'),
diff --git a/js/src/forum/helpers/canStartPrivateDiscussion.js b/js/src/forum/helpers/canStartPrivateDiscussion.js
new file mode 100644
index 0000000..97c697f
--- /dev/null
+++ b/js/src/forum/helpers/canStartPrivateDiscussion.js
@@ -0,0 +1,10 @@
+import app from 'flarum/forum/app';
+
+export default function canStartPrivateDiscussion(recipient) {
+  return (
+    app.session.user &&
+    app.session.user.id() !== recipient.id() &&
+    app.forum.attribute('canStartPrivateDiscussion') &&
+    (!recipient.blocksPd() || (app.forum.attribute('canStartPrivateDiscussionWithBlockers') && recipient.cannotBeDirectMessaged()))
+  );
+}
diff --git a/js/src/forum/pages/PrivateDiscussionsUserPage.js b/js/src/forum/pages/PrivateDiscussionsUserPage.js
index 6ca382c..2d565b1 100644
--- a/js/src/forum/pages/PrivateDiscussionsUserPage.js
+++ b/js/src/forum/pages/PrivateDiscussionsUserPage.js
@@ -5,10 +5,11 @@ import Button from 'flarum/common/components/Button';
 import Dropdown from 'flarum/common/components/Dropdown';
 import ItemList from 'flarum/common/utils/ItemList';
 import listItems from 'flarum/common/helpers/listItems';
 import PrivateDiscussionList from './discussions/PrivateDiscussionList';
 import PrivateComposing from './PrivateComposing';
+import canStartPrivateDiscussion from '../helpers/canStartPrivateDiscussion';
 
 export default class PrivateDiscussionsUserPage extends UserPage {
   oninit(vnode) {
     super.oninit(vnode);
 
@@ -55,11 +56,11 @@ export default class PrivateDiscussionsUserPage extends UserPage {
   actionItems() {
     let composing = new PrivateComposing(this.user);
 
     const items = new ItemList();
 
-    if (app.session.user && app.forum.attribute('canStartPrivateDiscussion')) {
+    if (canStartPrivateDiscussion(this.user)) {
       items.add('start_private', composing.component());
     }
 
     return items;
   }
diff --git a/src/Discussion/Screener.php b/src/Discussion/Screener.php
index fc11d8d..26401e4 100644
--- a/src/Discussion/Screener.php
+++ b/src/Discussion/Screener.php
@@ -105,11 +105,11 @@ class Screener extends Fluent
 
     public function hasBlockingUsers(): bool
     {
         return $this->users
             ->first(function (User $user) {
-                return $user->getPreference('blocksPd', false);
+                return boolval($user->blocks_byobu_pd);
             }) !== null;
     }
 
     public function deleted(string $type)
     {

Vulnerable code:     if (
      app.session.user &&
      app.session.user.id() !== user.id() &&
      app.forum.attribute('canStartPrivateDiscussion') &&
      (user.blocksPd() === false || (app.forum.attribute('canStartPrivateDiscussionWithBlockers') && user.cannotBeDirectMessaged()))
    ) {
    if (app.session.user && app.forum.attribute('canStartPrivateDiscussion')) {
                return $user->getPreference('blocksPd', false);
Fixed code: import canStartPrivateDiscussion from '../helpers/canStartPrivateDiscussion';
    if (canStartPrivateDiscussion(user)) {
import app from 'flarum/forum/app';

export default function canStartPrivateDiscussion(recipient) {
  return (
    app.session.user &&
    app.session.user.id() !== recipient.id() &&
    app.forum.attribute('canStartPrivateDiscussion') &&
    (!recipient.blocksPd() || (app.forum.attribute('canStartPrivateDiscussionWithBlockers') && recipient.cannotBeDirectMessaged()))
  );
}
import canStartPrivateDiscussion from '../helpers/canStartPrivateDiscussion';
    if (canStartPrivateDiscussion(this.user)) {
                return boolval($user->blocks_byobu_pd);