CVE-2022-0932 (Python, published 2022-03-11T15:15Z)
Description: value: Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/saleor/saleor
Files changed:
CHANGELOG.md
saleor/graphql/account/tests/benchmark/test_account.py
saleor/graphql/account/tests/test_account.py
saleor/graphql/account/types.py
Commit message: Require manage orders for fetching `user.orders` (#9128)

* Require manage orders for fetching customer.orders

* Update changelog

Co-authored-by: Marcin Gębala <5421321+maarcingebala@users.noreply.github.com>

Vulnerable code:
        query, variables, permissions=[permission_manage_staff]
    staff_api_client.user.user_permissions.set([permission_manage_users])
    staff_api_client.user.user_permissions.add(permission_manage_users)
        query, variables, permissions=[permission_manage_users]
        graphene.Node.to_global_id("Order", order.pk)
        for order in [order_unfulfilled, order_unconfirmed]
    app.permissions.add(permission_manage_staff, permission_manage_users)
    staff_api_client.user.user_permissions.add(permission_manage_users)
                orders = list(
                    filter(lambda order: order.status != OrderStatus.DRAFT, orders)
                )

Fixed code:
- Require manage orders for fetching `user.orders` - #9128 by @IKarbowiak
  - only staff with `manage orders` and can fetch customer orders
  - the customer can fetch his own orders, except drafts
        query,
        variables,
        permissions=[permission_manage_staff, permission_manage_orders],
    permission_manage_orders,
    staff_api_client.user.user_permissions.set(
        [permission_manage_users, permission_manage_orders]
    )
    permission_manage_orders,
    staff_api_client.user.user_permissions.add(
        permission_manage_users, permission_manage_orders
    )
    permission_manage_orders,
        query,
        variables,
        permissions=[permission_manage_users, permission_manage_orders],
        graphene.Node.to_global_id("Order", order.pk) for order in order_list
def test_query_customer_user_with_orders_no_manage_orders_perm(
    staff_api_client,
    customer_user,
    order_list,
    permission_manage_users,
):
    # given
    query = FULL_USER_QUERY
    order_unfulfilled = order_list[0]
    order_unfulfilled.user = customer_user

    order_unconfirmed = order_list[1]
    order_unconfirmed.status = OrderStatus.UNCONFIRMED
    order_unconfirmed.user = customer_user

    order_draft = order_list[2]
    order_draft.status = OrderStatus.DRAFT
    order_draft.user = customer_user

    Order.objects.bulk_update(
        [order_unconfirmed, order_draft, order_unfulfilled], ["user", "status"]
    )

    id = graphene.Node.to_global_id("User", customer_user.id)
    variables = {"id": id}

    # when
    response = staff_api_client.post_graphql(
        query, variables, permissions=[permission_manage_users]
    )

    # then
    assert_no_permission(response)


    permission_manage_orders,
    app.permissions.add(
        permission_manage_staff, permission_manage_users, permission_manage_orders
    )
def test_query_customer_user_with_orders_by_app_no_manage_orders_perm(
    app_api_client,
    customer_user,
    order_list,
    permission_manage_users,
):
    # given
    query = FULL_USER_QUERY
    order_unfulfilled = order_list[0]
    order_unfulfilled.user = customer_user

    order_unconfirmed = order_list[1]
    order_unconfirmed.status = OrderStatus.UNCONFIRMED
    order_unconfirmed.user = customer_user

    order_draft = order_list[2]
    order_draft.status = OrderStatus.DRAFT
    order_draft.user = customer_user

    Order.objects.bulk_update(
        [order_unconfirmed, order_draft, order_unfulfilled], ["user", "status"]
    )

    id = graphene.Node.to_global_id("User", customer_user.id)
    variables = {"id": id}

    # when
    response = app_api_client.post_graphql(
        query, variables, permissions=[permission_manage_users]
    )

    # then
    assert_no_permission(response)


    permission_manage_orders,
    staff_api_client.user.user_permissions.add(
        permission_manage_users, permission_manage_orders
    )
                # allow fetch requestor orders (except drafts)
                if root == info.context.user:
                    orders = list(
                        filter(lambda order: order.status != OrderStatus.DRAFT, orders)
                    )
                else:
                    raise PermissionDenied()