CVE-2024-37167 (PHP, published 2024-06-25T20:15Z)
Description: value: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users are able to see backlog items that they should not see. This issue has been patched in Tuleap Community Edition version 15.9.99.97.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Enalean/tuleap
Files changed:
plugins/agiledashboard/include/AgileDashboard/Milestone/Backlog/BacklogItemCollectionFactory.class.php
plugins/agiledashboard/include/AgileDashboard/REST/v1/ContentForMiletoneProvider.php
plugins/agiledashboard/include/AgileDashboard/REST/v1/MilestoneResource.class.php
plugins/agiledashboard/include/AgileDashboard/REST/v1/ProjectBacklogResource.class.php
plugins/agiledashboard/include/AgileDashboard/REST/v2/ProjectBacklogResource.class.php
plugins/agiledashboard/include/agiledashboardPlugin.php
plugins/agiledashboard/tests/unit/AgileDashboard/Milestone/Backlog/AgileDashboard_Milestone_Backlog_BacklogItemCollectionFactoryTest.php
plugins/cardwall/include/Pane.class.php
plugins/projectmilestones/include/Widget/ProjectMilestonesPresenterBuilder.php
plugins/tracker/include/Tracker/Permission/TrackersPermissionsRetriever.php
plugins/tracker/tests/unit/Stub/Tracker/Permission/TrackersPermissionsPassthroughRetriever.php
Commit message: fix: request #38297 Permissions of the backlog items are not verified

Change-Id: I5ea5e5cb4e5d320e77cb174fda9c598fd4604963


Vulnerable code:
        foreach ($item_collection as $artifact) {
        $backlog_item_ids  = [];
            $backlog_item_ids[]            = $artifact->getId();
            $backlog_item_ids,
        $backlog_item_ids = [];
        $artifacts        = [];
            $backlog_item_ids[]            = $artifact->getId();
            $backlog_item_ids,
        array $backlog_item_ids,
        foreach ($open_artifacts as $artifact) {
                new Tracker_Artifact_PriorityDao()
            new Tracker_Artifact_PriorityDao()
            new Tracker_Artifact_PriorityDao()
            new \Tracker_Artifact_PriorityDao()
            new Tracker_Artifact_PriorityDao()
            new Tracker_Artifact_PriorityDao()
                new Tracker_Artifact_PriorityDao()
        if (! self::isEnabled()) {
            throw new LogicException('Trackers permissions on tracker are disabled by feature flag.');
        }


Fixed code:
use Tuleap\Tracker\Permission\RetrieveUserPermissionOnArtifacts;
        private readonly RetrieveUserPermissionOnArtifacts $user_permission_on_artifacts_retriever,
        $permissions_on_items = $this->user_permission_on_artifacts_retriever->retrieveUserPermissionOnArtifacts(
            $user,
            iterator_to_array($item_collection),
            \Tuleap\Tracker\Permission\ArtifactPermissionType::PERMISSION_VIEW
        );

        foreach ($permissions_on_items->allowed as $artifact) {
        $artifacts = [];
    /**
     * @param Artifact[] $open_artifacts
     */
        $permissions_on_items = $this->user_permission_on_artifacts_retriever->retrieveUserPermissionOnArtifacts(
            $user,
            $open_artifacts,
            \Tuleap\Tracker\Permission\ArtifactPermissionType::PERMISSION_VIEW,
        );

        $backlog_item_ids = [];
        foreach ($permissions_on_items->allowed as $artifact) {
            $backlog_item_ids[] = $artifact->getId();
        }

        foreach ($permissions_on_items->allowed as $artifact) {
                new Tracker_Artifact_PriorityDao(),
                \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
            new Tracker_Artifact_PriorityDao(),
            \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
            new Tracker_Artifact_PriorityDao(),
            \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
            new \Tracker_Artifact_PriorityDao(),
            \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
            new Tracker_Artifact_PriorityDao(),
            \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
use Tuleap\Tracker\Test\Stub\Tracker\Permission\TrackersPermissionsPassthroughRetriever;
                new TrackersPermissionsPassthroughRetriever(),
            new Tracker_Artifact_PriorityDao(),
            \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
                new Tracker_Artifact_PriorityDao(),
                \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
<?php
/**
 * Copyright (c) Enalean, 2024-Present. All Rights Reserved.
 *
 * This file is a part of Tuleap.
 *
 * Tuleap is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * Tuleap is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with Tuleap. If not, see <http://www.gnu.org/licenses/>.
 */

declare(strict_types=1);

namespace Tuleap\Tracker\Test\Stub\Tracker\Permission;

use PFUser;
use Tuleap\Tracker\Permission\ArtifactPermissionType;
use Tuleap\Tracker\Permission\FieldPermissionType;
use Tuleap\Tracker\Permission\RetrieveUserPermissionOnArtifacts;
use Tuleap\Tracker\Permission\RetrieveUserPermissionOnFields;
use Tuleap\Tracker\Permission\RetrieveUserPermissionOnTrackers;
use Tuleap\Tracker\Permission\TrackerPermissionType;
use Tuleap\Tracker\Permission\UserPermissionsOnItems;

final readonly class TrackersPermissionsPassthroughRetriever implements RetrieveUserPermissionOnFields, RetrieveUserPermissionOnTrackers, RetrieveUserPermissionOnArtifacts
{
    public function retrieveUserPermissionOnArtifacts(
        PFUser $user,
        array $artifacts,
        ArtifactPermissionType $permission,
    ): UserPermissionsOnItems {
        return new UserPermissionsOnItems($user, $permission, $artifacts, []);
    }

    public function retrieveUserPermissionOnFields(
        PFUser $user,
        array $fields,
        FieldPermissionType $permission,
    ): UserPermissionsOnItems {
        return new UserPermissionsOnItems($user, $permission, $fields, []);
    }

    public function retrieveUserPermissionOnTrackers(
        PFUser $user,
        array $trackers,
        TrackerPermissionType $permission,
    ): UserPermissionsOnItems {
        return new UserPermissionsOnItems($user, $permission, $trackers, []);
    }
}