TireSwingSoftware/openassign-server — Issue #67: Unprivileged data injection via create() methods
Author: jc0n
Created: 2012-01-08 01:21:22+00:00
State: open
Labels: behavior, security

It appears that the practice of authorizing operations after the objects manipulated is harmful particularly in cases where the data is explicitly commited via a call to `save()` after being created. I was hoping to find some transactional logic that wrapped the calls such as commit on success, but I have not found anything like this.

Using a python shell I have confirmed some of these cases will raise a permission denied exception while the data remains in the database.

`./manage.py shell`

*Creating an active user:*

```python
import facade
from pr_services.user_system.user_manager import UserManager
User = facade.models.User
u = UserManager()
#permission denied is raised but the data is still there
u.create('', 'test user', 'asdf', 'Mr', 'joe', 'blow', '111.222.3333','asdf@asdf.com', 'active')
User.objects.all()
```

I was able to create an active user and add a UserOrgRole for the Admin role without using an admin token.

Some relevant code sections:

- https://github.com/TireSwingSoftware/openassign-server/blob/dev/pr_services/user_system/user_organization_role_manager.py#L59

- https://github.com/TireSwingSoftware/openassign-server/blob/dev/pr_services/user_system/user_manager.py#L239

- https://github.com/TireSwingSoftware/openassign-server/blob/dev/pr_services/exam_system/exam_manager.py#L70

- https://github.com/TireSwingSoftware/openassign-server/blob/dev/pr_services/exam_system/question_manager.py#L147

- https://github.com/TireSwingSoftware/openassign-server/blob/dev/pr_services/exam_system/question_pool_manager.py#L74

- https://github.com/TireSwingSoftware/openassign-server/blob/dev/pr_services/exam_system/answer_manager.py#L92