CVE-2017-15200 (PHP, published 2017-10-11T01:32Z)
Description: value: In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of another user.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/kanboard/kanboard
Files changed:
app/Controller/BaseController.php
app/Controller/CommentController.php
app/Controller/SubtaskController.php
app/Controller/SubtaskConverterController.php
app/Controller/SubtaskRestrictionController.php
app/Controller/SubtaskStatusController.php
app/Controller/TaskExternalLinkController.php
app/Controller/TaskInternalLinkController.php
app/Controller/TaskModificationController.php
app/Controller/TaskRecurrenceController.php
app/Template/comment/create.php
app/Template/comment/edit.php
app/Template/subtask/create.php
app/Template/subtask/edit.php
app/Template/task_external_link/edit.php
app/Template/task_external_link/find.php
app/Template/task_external_link/form.php
app/Template/task_internal_link/create.php
app/Template/task_internal_link/edit.php
app/Template/task_modification/show.php
Commit message: Do not expose IDs in forms


Vulnerable code:
    /**
     * Get the current subtask
     *
     * @access protected
     * @return array
     * @throws PageNotFoundException
     */
    protected function getSubtask()
    /**
     * Get the current comment
     *
     * @access protected
     * @return array
     * @throws PageNotFoundException
     * @throws AccessForbiddenException
     */
    protected function getComment()
    {
        $comment = $this->commentModel->getById($this->request->getIntegerParam('comment_id'));

        if (empty($comment)) {
            throw new PageNotFoundException();
        }

        if (! $this->userSession->isAdmin() && $comment['user_id'] != $this->userSession->getId()) {
            throw new AccessForbiddenException();
        }

        return $comment;
    }


        if (empty($values)) {
            $values = array(
                'user_id' => $this->userSession->getId(),
                'task_id' => $task['id'],
            );
        }

        $comment = $this->getComment();
        $this->getComment();
        $comment = $this->getComment();
        $comment = $this->getComment();
        $subtask = $this->getSubtask();
        $this->getSubtask();
        $subtask = $this->getSubtask();
        $subtask = $this->getSubtask();
        $subtask = $this->getSubtask();
        $subtask = $this->getSubtask();
        $subtask = $this->getSubtask();
        $subtask = $this->getSubtask();
        $subtask = $this->getSubtask();
        $subtaskId = $this->request->getIntegerParam('subtask_id');
            $this->subtaskTimeTrackingModel->logStartTime($subtaskId, $this->userSession->getId());
            $this->subtaskTimeTrackingModel->logEndTime($subtaskId, $this->userSession->getId());
            'subtask' => $this->subtaskModel->getByIdWithDetails($subtaskId),
        $link_id = $this->request->getIntegerParam('link_id');

        if ($link_id > 0) {
            $values = $this->taskExternalLinkModel->getById($link_id);
        }

        if (empty($values)) {
            throw new PageNotFoundException();
        }

        $provider = $this->externalLinkManager->getProvider($values['link_type']);
            'values' => $values,
            'errors' => $errors,
            'task' => $task,
        $link_id = $this->request->getIntegerParam('link_id');
        $link = $this->taskExternalLinkModel->getById($link_id);

        if (empty($link)) {
            throw new PageNotFoundException();
        }
        if ($this->taskExternalLinkModel->remove($this->request->getIntegerParam('link_id'))) {
    /**
     * Get the current link
     *
     * @access private
     * @return array
     * @throws PageNotFoundException
     */
    private function getTaskLink()
    {
        $link = $this->taskLinkModel->getById($this->request->getIntegerParam('link_id'));

        if (empty($link)) {
            throw new PageNotFoundException();
        }

        return $link;
    }

          $values = array(
              'another_tasklink' => $this->request->getIntegerParam('another_tasklink', 0)
          );
        $task_link = $this->getTaskLink();
        $link = $this->getTaskLink();
        if ($this->taskLinkModel->remove($this->request->getIntegerParam('link_id'))) {
    <?= $this->form->hidden('task_id', $values) ?>
    <?= $this->form->hidden('user_id', $values) ?>
    <?= $this->form->hidden('id', $values) ?>
    <?= $this->form->hidden('task_id', $values) ?>
    <?= $this->form->hidden('user_id', $values) ?>

    <?= $this->form->hidden('task_id', $values) ?>
    <?= $this->form->hidden('id', $values) ?>
    <?= $this->form->hidden('task_id', $values) ?>
<form action="<?= $this->url->href('TaskExternalLinkController', 'update', array('task_id' => $task['id'], 'project_id' => $task['project_id'])) ?>" method="post" autocomplete="off">
    <?= $this->form->hidden('task_id', array('task_id' => $task['id'])) ?>
<?= $this->form->hidden('task_id', array('task_id' => $task['id'])) ?>
<?= $this->form->hidden('id', $values) ?>
    <?= $this->form->hidden('task_id', array('task_id' => $task['id'])) ?>

    <?= $this->form->hidden('id', $values) ?>
    <?= $this->form->hidden('task_id', $values) ?>
    <?= $this->form->hidden('id', $values) ?>
    <?= $this->form->hidden('project_id', $values) ?>

Fixed code:
    protected function getSubtask(array $task)
        if ($subtask['task_id'] != $task['id']) {
            throw new AccessForbiddenException();
        }

    protected function getComment(array $task)
    {
        $comment = $this->commentModel->getById($this->request->getIntegerParam('comment_id'));

        if (empty($comment)) {
            throw new PageNotFoundException();
        }

        if (! $this->userSession->isAdmin() && $comment['user_id'] != $this->userSession->getId()) {
            throw new AccessForbiddenException();
        }

        if ($comment['task_id'] != $task['id']) {
            throw new AccessForbiddenException();
        }

        return $comment;
    }

    protected function getExternalTaskLink(array $task)
    {
        $link = $this->taskExternalLinkModel->getById($this->request->getIntegerParam('link_id'));

        if (empty($link)) {
            throw new PageNotFoundException();
        }

        if ($link['task_id'] != $task['id']) {
            throw new AccessForbiddenException();
        }

        return $link;
    }

    protected function getInternalTaskLink(array $task)
    {
        $link = $this->taskLinkModel->getById($this->request->getIntegerParam('link_id'));

        if (empty($link)) {
            throw new PageNotFoundException();
        }

        if ($link['task_id'] != $task['id']) {
            throw new AccessForbiddenException();
        }

        return $link;
    }

        $comment = $this->getComment($task);
        $comment = $this->getComment($task);
        $values['id'] = $comment['id'];
        $values['task_id'] = $task['id'];
        $values['user_id'] = $comment['user_id'];

        $comment = $this->getComment($task);
        $comment = $this->getComment($task);
        $values['task_id'] = $task['id'];
        $subtask = $this->getSubtask($task);
        $subtask = $this->getSubtask($task);
        $values['id'] = $subtask['id'];
        $values['task_id'] = $task['id'];

        $subtask = $this->getSubtask($task);
        $subtask = $this->getSubtask($task);
        $subtask = $this->getSubtask($task);
        $task = $this->getTask();
        $subtask = $this->getSubtask($task);
        $subtask = $this->getSubtask($task);
        $subtask = $this->getSubtask($task);
        $subtask = $this->getSubtask($task);
        $subtask = $this->getSubtask($task);
            $this->subtaskTimeTrackingModel->logStartTime($subtask['id'], $this->userSession->getId());
            $this->subtaskTimeTrackingModel->logEndTime($subtask['id'], $this->userSession->getId());
            'subtask' => $this->subtaskModel->getByIdWithDetails($subtask['id']),
        $values['task_id'] = $task['id'];

        $link = $this->getExternalTaskLink($task);
        $provider = $this->externalLinkManager->getProvider($link['link_type']);
            'values'       => empty($values) ? $link : $values,
            'errors'       => $errors,
            'task'         => $task,
            'link'         => $link,
        $link = $this->getExternalTaskLink($task);

        $values['id'] = $link['id'];
        $values['task_id'] = $link['task_id'];

        $link = $this->getExternalTaskLink($task);
        $link = $this->getExternalTaskLink($task);
        if ($this->taskExternalLinkModel->remove($link['id'])) {
          $values['another_tasklink'] = $this->request->getIntegerParam('another_tasklink', 0);
        $values['task_id'] = $task['id'];
        $task_link = $this->getInternalTaskLink($task);
        $task_link = $this->getInternalTaskLink($task);

        $values['task_id'] = $task['id'];
        $values['id'] = $task_link['id'];
        $link = $this->getInternalTaskLink($task);
        $link = $this->getInternalTaskLink($task);
        if ($this->taskLinkModel->remove($link['id'])) {
        $values['id'] = $task['id'];
        $values['project_id'] = $task['project_id'];
        $values['id'] = $task['id'];

<form action="<?= $this->url->href('TaskExternalLinkController', 'update', array('task_id' => $task['id'], 'project_id' => $task['project_id'], 'link_id' => $link['id'])) ?>" method="post" autocomplete="off">