sonata-project/SonataAdminBundle — pull request #2037 by Dropaq (2014-04-04 13:42:18+00:00)
Title: Security issue in Create Action

There is a missing check for newly created entities.

Example is not a real case, since our system is still under development, but it describes a vector of attack.

For example we have an admin-user who has relation to few notice boards. And this user can add the advertisements only on his own board.

This check provided by appropriate voter. And obviously list of available boards is filtered by query.

But our violator can substitute board_id with id of somebody else's board and submit his request. By the way he is no longer can operate with submitted advertisement, because isGranted('EDIT', $object) will return false due to voter logic. But he can still do a lot of spam submissions because of missed isGranted('CREATE', $object) and as a result missed voter call.