CVE-2022-35921 (published 2022-08-01T22:15Z)

fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of Byobu should update the extension to version 1.1.7, where this has been patched. Users of Byobu with Flarum 1.0 or 1.1 should upgrade to Flarum 1.2 or later, or evaluate the impact this issue has on your forum's users and choose to disable the extension if needed. There are no workarounds for this issue.

CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/FriendsOfFlarum/byobu
commit_details: repo_url: https://github.com/FriendsOfFlarum/byobu
author: Rafał Całka
author_date: 2022-07-31 22:27:43+02:00
msg: fix: prevent starting a PD with users blocking them (#175)
repository: repo_url: https://github.com/FriendsOfFlarum/byobu
repo_name: FriendsOfFlarum/byobu
description: Well integrated, advanced private discussions for your Flarum forum.
repo_language: PHP
owner: FriendsOfFlarum
file_changes: filename: User.js
change_type: ModificationType.MODIFY
diff: @@ -8,6 +8,7 @@ import Button from 'flarum/common/components/Button';
 import ItemList from 'flarum/common/utils/ItemList';
 import UserPage from 'flarum/forum/components/UserPage';
 import LinkButton from 'flarum/common/components/LinkButton';
+import canStartPrivateDiscussion from '../helpers/canStartPrivateDiscussion';
 
 export default () => {
   attributes();
@@ -17,12 +18,7 @@ export default () => {
 
 function message() {
   extend(UserControls, 'userControls', function (items, user) {
-    if (
-      app.session.user &&
-      app.session.user.id() !== user.id() &&
-      app.forum.attribute('canStartPrivateDiscussion') &&
-      (user.blocksPd() === false || (app.forum.attribute('canStartPrivateDiscussionWithBlockers') && user.cannotBeDirectMessaged()))
-    ) {
+    if (canStartPrivateDiscussion(user)) {
       items.add(
         'private-discussion',
         Button.component(

programming_language: TypeScript
filename: canStartPrivateDiscussion.js
change_type: ModificationType.ADD
diff: @@ -0,0 +1,10 @@
+import app from 'flarum/forum/app';
+
+export default function canStartPrivateDiscussion(recipient) {
+  return (
+    app.session.user &&
+    app.session.user.id() !== recipient.id() &&
+    app.forum.attribute('canStartPrivateDiscussion') &&
+    (!recipient.blocksPd() || (app.forum.attribute('canStartPrivateDiscussionWithBlockers') && recipient.cannotBeDirectMessaged()))
+  );
+}

programming_language: JavaScript
filename: PrivateDiscussionsUserPage.js
change_type: ModificationType.MODIFY
diff: @@ -7,6 +7,7 @@ import ItemList from 'flarum/common/utils/ItemList';
 import listItems from 'flarum/common/helpers/listItems';
 import PrivateDiscussionList from './discussions/PrivateDiscussionList';
 import PrivateComposing from './PrivateComposing';
+import canStartPrivateDiscussion from '../helpers/canStartPrivateDiscussion';
 
 export default class PrivateDiscussionsUserPage extends UserPage {
   oninit(vnode) {
@@ -57,7 +58,7 @@ export default class PrivateDiscussionsUserPage extends UserPage {
 
     const items = new ItemList();
 
-    if (app.session.user && app.forum.attribute('canStartPrivateDiscussion')) {
+    if (canStartPrivateDiscussion(this.user)) {
       items.add('start_private', composing.component());
     }
 

programming_language: TypeScript
filename: Screener.php
change_type: ModificationType.MODIFY
diff: @@ -107,7 +107,7 @@ class Screener extends Fluent
     {
         return $this->users
             ->first(function (User $user) {
-                return $user->getPreference('blocksPd', false);
+                return boolval($user->blocks_byobu_pd);
             }) !== null;
     }
 

programming_language: PHP