CVE-2023-2590: Missing Authorization (CWE-862)
value: Missing Authorization in GitHub repository answerdev/answer prior to 1.0.9.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 3.5
Published: 2023-05-09T06:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: internal/migrations/init.go, internal/migrations/migrations.go, internal/migrations/v3.go, internal/migrations/v9.go
Commit date: 2023-04-21 16:52:22 +0800
Commit message: fix(rank): update answer accept rank config

Diff: diff --git a/internal/migrations/init.go b/internal/migrations/init.go
index 1d0c5a256..93bd0eec0 100644
--- a/internal/migrations/init.go
+++ b/internal/migrations/init.go
@@ -268,11 +268,11 @@ func initConfigTable(engine *xorm.Engine) error {
 		{ID: 39, Key: "rank.question.vote_up", Value: `15`},
 		{ID: 40, Key: "rank.question.vote_down", Value: `125`},
 		{ID: 41, Key: "rank.answer.add", Value: `1`},
 		{ID: 42, Key: "rank.answer.edit", Value: `200`},
 		{ID: 43, Key: "rank.answer.delete", Value: `-1`},
-		{ID: 44, Key: "rank.answer.accept", Value: `1`},
+		{ID: 44, Key: "rank.answer.accept", Value: `-1`},
 		{ID: 45, Key: "rank.answer.vote_up", Value: `15`},
 		{ID: 46, Key: "rank.answer.vote_down", Value: `125`},
 		{ID: 47, Key: "rank.comment.add", Value: `1`},
 		{ID: 48, Key: "rank.comment.edit", Value: `-1`},
 		{ID: 49, Key: "rank.comment.delete", Value: `-1`},
diff --git a/internal/migrations/migrations.go b/internal/migrations/migrations.go
index 00ae9bc02..787c72f4f 100644
--- a/internal/migrations/migrations.go
+++ b/internal/migrations/migrations.go
@@ -55,10 +55,11 @@ var migrations = []Migration{
 	NewMigration("add activity timeline", addActivityTimeline, false),
 	NewMigration("add user role", addRoleFeatures, false),
 	NewMigration("add theme and private mode", addThemeAndPrivateMode, true),
 	NewMigration("add new answer notification", addNewAnswerNotification, true),
 	NewMigration("add user pin hide features", addRolePinAndHideFeatures, true),
+	NewMigration("update accept answer rank", updateAcceptAnswerRank, true),
 }
 
 // GetCurrentDBVersion returns the current db version
 func GetCurrentDBVersion(engine *xorm.Engine) (int64, error) {
 	if err := engine.Sync(new(entity.Version)); err != nil {
diff --git a/internal/migrations/v3.go b/internal/migrations/v3.go
index 076a72b55..2d9b28eb0 100644
--- a/internal/migrations/v3.go
+++ b/internal/migrations/v3.go
@@ -108,11 +108,11 @@ ON "question" (
 		{ID: 39, Key: "rank.question.vote_up", Value: `15`},
 		{ID: 40, Key: "rank.question.vote_down", Value: `125`},
 		{ID: 41, Key: "rank.answer.add", Value: `1`},
 		{ID: 42, Key: "rank.answer.edit", Value: `200`},
 		{ID: 43, Key: "rank.answer.delete", Value: `-1`},
-		{ID: 44, Key: "rank.answer.accept", Value: `1`},
+		{ID: 44, Key: "rank.answer.accept", Value: `-1`},
 		{ID: 45, Key: "rank.answer.vote_up", Value: `15`},
 		{ID: 46, Key: "rank.answer.vote_down", Value: `125`},
 		{ID: 47, Key: "rank.comment.add", Value: `1`},
 		{ID: 48, Key: "rank.comment.edit", Value: `-1`},
 		{ID: 49, Key: "rank.comment.delete", Value: `-1`},
diff --git a/internal/migrations/v9.go b/internal/migrations/v9.go
new file mode 100644
index 000000000..fadd1bc6c
--- /dev/null
+++ b/internal/migrations/v9.go
@@ -0,0 +1,18 @@
+package migrations
+
+import (
+	"fmt"
+
+	"github.com/answerdev/answer/internal/entity"
+	"github.com/segmentfault/pacman/log"
+	"xorm.io/xorm"
+)
+
+func updateAcceptAnswerRank(x *xorm.Engine) error {
+	c := &entity.Config{ID: 44, Key: "rank.answer.accept", Value: `-1`}
+	if _, err := x.Update(c, &entity.Config{ID: 44, Key: "rank.answer.accept"}); err != nil {
+		log.Errorf("update %+v config failed: %s", c, err)
+		return fmt.Errorf("update config failed: %w", err)
+	}
+	return nil
+}

Vulnerable code: 		{ID: 44, Key: "rank.answer.accept", Value: `1`},
		{ID: 44, Key: "rank.answer.accept", Value: `1`},
Fixed code: 		{ID: 44, Key: "rank.answer.accept", Value: `-1`},
	NewMigration("update accept answer rank", updateAcceptAnswerRank, true),
		{ID: 44, Key: "rank.answer.accept", Value: `-1`},
package migrations

import (
	"fmt"

	"github.com/answerdev/answer/internal/entity"
	"github.com/segmentfault/pacman/log"
	"xorm.io/xorm"
)

func updateAcceptAnswerRank(x *xorm.Engine) error {
	c := &entity.Config{ID: 44, Key: "rank.answer.accept", Value: `-1`}
	if _, err := x.Update(c, &entity.Config{ID: 44, Key: "rank.answer.accept"}); err != nil {
		log.Errorf("update %+v config failed: %s", c, err)
		return fmt.Errorf("update config failed: %w", err)
	}
	return nil
}