CVE-2021-41082 (Ruby, published 2021-09-20T21:15Z)
Description: value: Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed to users that do not have access to the private messages. However, access control for the private messages was not compromised as users were not able to view the posts in the leaked private message despite seeing it in their inbox. The problematic commit was reverted around 32 minutes after it was made. Users are encouraged to upgrade to the latest commit if they are running Discourse against the `tests-passed` branch.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/discourse/discourse
Files changed:
app/controllers/topics_controller.rb
lib/topic_query/private_message_lists.rb
Commit message: Partially revert "PERF: Improve query performance all inbox private messages. (#14304)" (#14344)

This partially reverts commit ddb458343dc39a7a8c99467dcd809b444514fe2c.

Seeing performance degrade on larger sites so back to drawing board on
this one. Instead of the DISTINCT LEFT JOIN, we switch back to
IN(subquery).

Vulnerable code:
      topic_scope.distinct(false).pluck(:id),

      topic_query
        .filter_private_messages_unread(current_user, filter)
        .distinct(false)
        .pluck(:id)

      topics.pluck(:id)
        result = result.joins(<<~SQL)
        LEFT JOIN topic_allowed_users tau
          ON tau.topic_id = topics.id
          AND tau.user_id = #{user.id.to_i}
        LEFT JOIN topic_allowed_groups tag
          ON tag.topic_id = topics.id
          #{group_ids.present? ? "AND tag.group_id IN (#{group_ids.join(",")})" : ""}
        SQL

        result = result
          .where("tag.topic_id IS NOT NULL OR tau.topic_id IS NOT NULL")
          .distinct
      list = list.joins(<<~SQL)
      LEFT JOIN group_archived_messages gm
        ON gm.topic_id = topics.id
        #{group_ids.present? ? "AND gm.group_id IN (#{group_ids.join(",")})" : ""}
      LEFT JOIN user_archived_messages um
        ON um.user_id = #{user.id.to_i}
        AND um.topic_id = topics.id
      SQL
      list =
      list

Fixed code:
      topic_scope.pluck(:id),
      topics = topic_query.filter_private_messages_unread(current_user, filter)

    topics.pluck(:id)
        result =
        if group_ids.present?
          result.where(<<~SQL)
            topics.id IN (
              SELECT topic_id
              FROM topic_allowed_users
              WHERE user_id = #{user.id.to_i}
              UNION ALL
              SELECT topic_id FROM topic_allowed_groups
              WHERE group_id IN (#{group_ids.join(",")})
            )
          SQL
        else
          result.joins(<<~SQL)
          INNER JOIN topic_allowed_users tau
            ON tau.topic_id = topics.id
            AND tau.user_id = #{user.id.to_i}
          SQL
        end
      if group_ids.present?
        list = list.joins(<<~SQL)
          LEFT JOIN group_archived_messages gm
            ON gm.topic_id = topics.id
            AND gm.group_id IN (#{group_ids.join(",")})
          LEFT JOIN user_archived_messages um
            ON um.user_id = #{user.id.to_i}
            AND um.topic_id = topics.id
        SQL
      else
        list = list.joins(<<~SQL)
          LEFT JOIN user_archived_messages um
          ON um.user_id = #{user.id.to_i}
          AND um.topic_id = topics.id
        SQL
        list.where("um.user_id IS #{archived ? "NOT NULL" : "NULL"}")
      end