CVE-2022-31185: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: mprweb is a hosting platform for the makedeb Package Repository. Email addresses were found to not have been hidden, even if a user had clicked the `Hide Email Address` checkbox on their account page, or during signup. This could lead to an account's email being leaked, which may be problematic if your email needs to remain private for any reason. Users hosting their own mprweb instance will need to upgrade to the latest commit to get this fixed. Users on the official instance will already have this issue fixed.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2022-08-01T20:15Z
Repository: https://github.com/makedeb/mprweb
Language: HTML
Files changed: aurweb/routers/accounts.py, docker/redis-entrypoint.sh, templates/account/show.html, templates/partials/account_form.html
Commit date: 2022-07-25 01:32:44 -0500
Commit message: Redis and Hide Email Address fixes

Closes #97.

Diff: diff --git a/aurweb/routers/accounts.py b/aurweb/routers/accounts.py
index eb764a7e..14cc514c 100644
--- a/aurweb/routers/accounts.py
+++ b/aurweb/routers/accounts.py
@@ -268,11 +268,11 @@ async def account_register(
 @requires_guest
 async def account_register_post(
     request: Request,
     U: str = Form(default=str()),  # Username
     E: str = Form(default=str()),  # Email
-    H: str = Form(default=False),  # Hide Email
+    H: str = Form(default="off"),  # Hide Email
     BE: str = Form(default=None),  # Backup Email
     R: str = Form(default=""),  # Real Name
     HP: str = Form(default=None),  # Homepage
     I: str = Form(default=None),  # IRC Nick # noqa: E741
     K: str = Form(default=None),  # PGP Key
@@ -311,17 +311,23 @@ async def account_register_post(
     # By default, we grab the User account type to associate with.
     atype = db.query(
         models.AccountType, models.AccountType.AccountType == "User"
     ).first()
 
+    # Check if we should turn on HideEmail.
+    if H == "on":
+        hide_email = 1
+    else:
+        hide_email = 0
+
     # Create a user given all parameters available.
     with db.begin():
         user = db.create(
             models.User,
             Username=U,
             Email=E,
-            HideEmail=H,
+            HideEmail=hide_email,
             BackupEmail=BE,
             RealName=R,
             Homepage=HP,
             IRCNick=I,
             PGPKey=K,
diff --git a/docker/redis-entrypoint.sh b/docker/redis-entrypoint.sh
index e92be6c5..c6c116e6 100755
--- a/docker/redis-entrypoint.sh
+++ b/docker/redis-entrypoint.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 set -eou pipefail
 
-sed -ri 's/^bind .*$/bind 0.0.0.0 -::1/g' /etc/redis/redis.conf
+sed -ri -e 's/^bind .*$/bind 0.0.0.0 -::1/g' -e 's/^protected-mode .*$/protected-mode no/g' /etc/redis/redis.conf
 
 exec "$@"
diff --git a/templates/account/show.html b/templates/account/show.html
index a9de2033..ca3a124c 100644
--- a/templates/account/show.html
+++ b/templates/account/show.html
@@ -17,11 +17,15 @@
 		    <p class="caption">{% trans %}Account Type{% endtrans %}:</p>
 		    <p class="data">{{ user.AccountType }}</p>
 		</div>
 		<div class="item">
 		    <p class="caption">{% trans %}Email Address{% endtrans %}:</p>
+                    {% if request.user != user and user.HideEmail == 1 %}
+		    <p class="data">None</a></p>
+                    {% else %}
 		    <p class="data"><a href="mailto:{{ user.Email }}">{{ user.Email }}</a></p>
+                    {% endif %}
 		</div>
 		<div class="item">
 		    <p class="caption">{% trans %}Real Name{% endtrans %}:</p>
 		    {% if user.Realname != "" %}
 		        <p class="data">{{ user.Realname }}</p>
diff --git a/templates/partials/account_form.html b/templates/partials/account_form.html
index cdc2517e..4587435d 100644
--- a/templates/partials/account_form.html
+++ b/templates/partials/account_form.html
@@ -80,11 +80,11 @@
             <div>
                 <label for="id_hide">
                     {% trans %}Hide Email Address{% endtrans %}:
                 </label>
 
-                <input class="checkbox" id="id_hide" type="checkbox" name="H" {% if H %}checked="checked"{% endif %}>
+                <input class="checkbox" id="id_hide" type="checkbox" name="H" value="on" {% if H or request.user.HideEmail == 1 %}checked="checked"{% endif %}>
             </div>
             <p class="comment"><em>{{ "If you do not hide your email address, it is "
             "visible to all registered MPR users. If you hide your "
             "email address, it is visible to MPR "
             "Trusted Users only." | tr }}</em></p>

Vulnerable code:     H: str = Form(default=False),  # Hide Email
            HideEmail=H,
sed -ri 's/^bind .*$/bind 0.0.0.0 -::1/g' /etc/redis/redis.conf
                <input class="checkbox" id="id_hide" type="checkbox" name="H" {% if H %}checked="checked"{% endif %}>
Fixed code:     H: str = Form(default="off"),  # Hide Email
    # Check if we should turn on HideEmail.
    if H == "on":
        hide_email = 1
    else:
        hide_email = 0

            HideEmail=hide_email,
sed -ri -e 's/^bind .*$/bind 0.0.0.0 -::1/g' -e 's/^protected-mode .*$/protected-mode no/g' /etc/redis/redis.conf
                    {% if request.user != user and user.HideEmail == 1 %}
		    <p class="data">None</a></p>
                    {% else %}
                    {% endif %}
                <input class="checkbox" id="id_hide" type="checkbox" name="H" value="on" {% if H or request.user.HideEmail == 1 %}checked="checked"{% endif %}>