CVE-2023-4815 (published 2023-09-07T07:15Z)

Missing Authentication for Critical Function in GitHub repository answerdev/answer prior to v1.1.3.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-306
cwe_name: Missing Authentication for Critical Function
description: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/answerdev/answer
commit_details: repo_url: https://github.com/answerdev/answer
author: LinkinStars
author_date: 2023-08-29 11:39:51+08:00
msg: fix(answer): fix incorrect notification's triggerUserID when cancel accepted answer
repository: repo_url: https://github.com/answerdev/answer
repo_name: apache/incubator-answer
description: A Q&A platform software for teams at any scales. Whether it's a community forum, help center, or knowledge management platform, you can always count on Apache Answer.
repo_language: Go
owner: answerdev
file_changes: filename: auth.go
change_type: ModificationType.MODIFY
diff: @@ -126,7 +126,7 @@ func (am *AuthUserMiddleware) AdminAuth() gin.HandlerFunc {
 			return
 		}
 		userInfo, err := am.authService.GetAdminUserCacheInfo(ctx, token)
-		if err != nil {
+		if err != nil || userInfo == nil {
 			handler.HandleResponse(ctx, errors.Forbidden(reason.UnauthorizedError), nil)
 			ctx.Abort()
 			return

programming_language: Go
filename: answer_repo.go
change_type: ModificationType.MODIFY
diff: @@ -55,7 +55,6 @@ func (ar *AnswerActivityRepo) SaveAcceptAnswerActivity(ctx context.Context, op *
 		return nil
 	}
 
-	ar.data.DB.ShowSQL(true)
 	// save activity
 	_, err = ar.data.DB.Transaction(func(session *xorm.Session) (result any, err error) {
 		session = session.Context(ctx)
@@ -311,12 +310,11 @@ func (ar *AnswerActivityRepo) sendAcceptAnswerNotification(
 			Type:           schema.NotificationTypeAchievement,
 			ObjectID:       op.AnswerObjectID,
 			ReceiverUserID: act.ActivityUserID,
+			TriggerUserID:  act.TriggerUserID,
 		}
 		if act.ActivityUserID == op.QuestionUserID {
-			msg.TriggerUserID = op.AnswerUserID
 			msg.ObjectType = constant.AnswerObjectType
 		} else {
-			msg.TriggerUserID = op.QuestionUserID
 			msg.ObjectType = constant.AnswerObjectType
 		}
 		if msg.TriggerUserID != msg.ReceiverUserID {
@@ -329,9 +327,9 @@ func (ar *AnswerActivityRepo) sendAcceptAnswerNotification(
 			ReceiverUserID: act.ActivityUserID,
 			Type:           schema.NotificationTypeInbox,
 			ObjectID:       op.AnswerObjectID,
+			TriggerUserID:  op.TriggerUserID,
 		}
 		if act.ActivityUserID != op.QuestionUserID {
-			msg.TriggerUserID = op.QuestionUserID
 			msg.ObjectType = constant.AnswerObjectType
 			msg.NotificationAction = constant.NotificationAcceptAnswer
 			ar.notificationQueueService.Send(ctx, msg)
@@ -343,15 +341,14 @@ func (ar *AnswerActivityRepo) sendCancelAcceptAnswerNotification(
 	ctx context.Context, op *schema.AcceptAnswerOperationInfo) {
 	for _, act := range op.Activities {
 		msg := &schema.NotificationMsg{
+			TriggerUserID:  act.TriggerUserID,
 			ReceiverUserID: act.ActivityUserID,
 			Type:           schema.NotificationTypeAchievement,
 			ObjectID:       op.AnswerObjectID,
 		}
 		if act.ActivityUserID == op.QuestionObjectID {
-			msg.TriggerUserID = op.AnswerObjectID
 			msg.ObjectType = constant.QuestionObjectType
 		} else {
-			msg.TriggerUserID = op.QuestionObjectID
 			msg.ObjectType = constant.AnswerObjectType
 		}
 		if msg.TriggerUserID != msg.ReceiverUserID {

programming_language: Go