CVE-2022-0524: Business Logic Errors (CWE-840)
value: Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.
CWE description: Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.
CVSS v3 base score: 7.5
Published: 2022-02-08T22:15Z
Repository: https://github.com/publify/publify
Language: Ruby
Files changed: publify_core/app/controllers/admin/content_controller.rb, publify_core/spec/controllers/admin/content_controller_spec.rb
Commit date: 2022-02-07 23:13:44 +0100
Commit message: Fix setting the article password from the Admin

The password field was present in the form, but not accepted by the
controller. This change adds password to the list of accepted fields.

Diff: diff --git a/publify_core/app/controllers/admin/content_controller.rb b/publify_core/app/controllers/admin/content_controller.rb
index 5ebd608498..b86f381f49 100644
--- a/publify_core/app/controllers/admin/content_controller.rb
+++ b/publify_core/app/controllers/admin/content_controller.rb
@@ -178,10 +178,11 @@ class Admin::ContentController < Admin::BaseController
              :allow_pings,
              :body,
              :body_and_extended,
              :draft,
              :extended,
+             :password,
              :permalink,
              :published_at,
              :text_filter_name,
              :title,
              :keywords)
diff --git a/publify_core/spec/controllers/admin/content_controller_spec.rb b/publify_core/spec/controllers/admin/content_controller_spec.rb
index dd56999d78..9507186d98 100644
--- a/publify_core/spec/controllers/admin/content_controller_spec.rb
+++ b/publify_core/spec/controllers/admin/content_controller_spec.rb
@@ -158,10 +158,16 @@ describe Admin::ContentController, type: :controller do
         post :create, params: { "article" => base_article(keywords: "foo bar") }
         new_article = Article.last
         assert_equal 2, new_article.tags.size
       end
 
+      it "creates an article with a password" do
+        post :create, params: { "article" => base_article(password: "foobar") }
+        new_article = Article.last
+        expect(new_article.password).to eq("foobar")
+      end
+
       it "creates an article with a unique Tag instance named lang:FR" do
         post :create, params: { "article" => base_article(keywords: "lang:FR") }
         new_article = Article.last
         expect(new_article.tags.map(&:name)).to include("lang-fr")
       end
@@ -390,10 +396,19 @@ describe Admin::ContentController, type: :controller do
         article.reload
         expect(article.body).to eq("foo")
         expect(article.extended).to eq("bar<!--more-->baz")
       end
 
+      it "allows updating password" do
+        put :update, params: { "id" => article.id, "article" => {
+          "password" => "foobar",
+        } }
+        assert_response :redirect
+        article.reload
+        expect(article.password).to eq("foobar")
+      end
+
       context "when a published article has drafts" do
         let(:original_published_at) { 2.days.ago.to_date }
         let!(:original) { create(:article, published_at: original_published_at) }
         let!(:draft) { create(:article, parent_id: original.id, state: "draft") }
         let!(:second_draft) { create(:article, parent_id: original.id, state: "draft") }

Fixed code:              :password,
      it "creates an article with a password" do
        post :create, params: { "article" => base_article(password: "foobar") }
        new_article = Article.last
        expect(new_article.password).to eq("foobar")
      end

      it "allows updating password" do
        put :update, params: { "id" => article.id, "article" => {
          "password" => "foobar",
        } }
        assert_response :redirect
        article.reload
        expect(article.password).to eq("foobar")
      end