CVE-2022-0574 (published 2022-05-16T15:15Z)

Improper Access Control in GitHub repository publify/publify prior to 9.2.8.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/publify/publify
commit_details: repo_url: https://github.com/publify/publify
author: Matijs van Zuijlen
author_date: 2022-02-13 13:54:23+01:00
msg: Do not allow comments on Article if not published
repository: repo_url: https://github.com/publify/publify
repo_name: publify/publify
description: A self hosted Web publishing platform on Rails.
repo_language: Less
owner: publify
file_changes: filename: article.rb
change_type: ModificationType.MODIFY
diff: @@ -204,7 +204,7 @@ class Article < Content
   end
 
   def comments_closed?
-    !(allow_comments? && in_feedback_window?)
+    !(allow_comments? && published? && in_feedback_window?)
   end
 
   def html_urls

programming_language: Ruby
filename: comments_controller_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -58,6 +58,21 @@ RSpec.describe CommentsController, type: :controller do
         expect(response.body).to have_text "content"
       end
     end
+
+    it "does not allow commenting if article does not allow comments" do
+      no_comments = create(:article, allow_comments: false)
+      expect do
+        post :create, xhr: true, params: { comment: comment_params,
+                                           article_id: no_comments.id }
+      end.not_to change(no_comments.comments, :count)
+    end
+
+    it "does not allow commenting if article is draft" do
+      draft = create(:article, state: "draft")
+      expect do
+        post :create, xhr: true, params: { comment: comment_params, article_id: draft.id }
+      end.not_to change(draft.comments, :count)
+    end
   end
 
   describe "#preview" do

programming_language: Ruby
filename: article_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -856,8 +856,9 @@ describe Article, type: :model do
     it "returns only published articles" do
       article = create(:article)
       create(:comment, article: article)
-      unpublished_article = create(:article, state: "draft")
+      unpublished_article = create(:article)
       create(:comment, article: unpublished_article)
+      unpublished_article.update!(state: "draft")
       expect(described_class.published).to eq([article])
       expect(described_class.bestof).to eq([article])
     end
@@ -955,6 +956,17 @@ describe Article, type: :model do
     context "when auto_close setting is zero" do
       let(:auto_close_value) { 0 }
 
+      it "does not allow comments for a draft article" do
+        art = build :article, state: "draft", blog: blog
+        assert art.comments_closed?
+      end
+
+      it "does not allow comments for an article that will be published in the future" do
+        art = build :article, state: "publication_pending",
+                              published_at: 1.day.from_now, blog: blog
+        assert art.comments_closed?
+      end
+
       it "allows comments for a newly published article" do
         art = build :article, published_at: 1.second.ago, blog: blog
         assert !art.comments_closed?

programming_language: Ruby