CVE-2023-4124 (published 2023-08-03T04:15Z)

Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/answerdev/answer
commit_details: repo_url: https://github.com/answerdev/answer
author: LinkinStars
author_date: 2023-07-04 14:33:31+08:00
msg: feat(init): set default privileges when init
repository: repo_url: https://github.com/answerdev/answer
repo_name: apache/incubator-answer
description: A Q&A platform software for teams at any scales. Whether it's a community forum, help center, or knowledge management platform, you can always count on Apache Answer.
repo_language: Go
owner: answerdev
file_changes: filename: init.go
change_type: ModificationType.MODIFY
diff: @@ -4,6 +4,8 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"github.com/answerdev/answer/internal/schema"
+	"github.com/segmentfault/pacman/log"
 
 	"github.com/answerdev/answer/internal/entity"
 	"golang.org/x/crypto/bcrypt"
@@ -38,6 +40,7 @@ func (m *Mentor) InitDB() error {
 	m.do("init version table", m.initVersionTable)
 	m.do("init admin user", m.initAdminUser)
 	m.do("init config", m.initConfig)
+	m.do("init default privileges config", m.initDefaultRankPrivileges)
 	m.do("init role", m.initRole)
 	m.do("init power", m.initPower)
 	m.do("init role power rel", m.initRolePowerRel)
@@ -48,6 +51,7 @@ func (m *Mentor) InitDB() error {
 	m.do("init site info theme config", m.initSiteInfoThemeConfig)
 	m.do("init site info seo config", m.initSiteInfoSEOConfig)
 	m.do("init site info user config", m.initSiteInfoUsersConfig)
+	m.do("init site info privilege rank", m.initSiteInfoPrivilegeRank)
 	return m.err
 }
 
@@ -95,6 +99,19 @@ func (m *Mentor) initConfig() {
 	_, m.err = m.engine.Context(m.ctx).Insert(defaultConfigTable)
 }
 
+func (m *Mentor) initDefaultRankPrivileges() {
+	chooseOption := schema.DefaultPrivilegeOptions.Choose(schema.PrivilegeLevel2)
+	for _, privilege := range chooseOption.Privileges {
+		_, err := m.engine.Context(m.ctx).Update(
+			&entity.Config{Value: fmt.Sprintf("%d", privilege.Value)},
+			&entity.Config{Key: privilege.Key},
+		)
+		if err != nil {
+			log.Error(err)
+		}
+	}
+}
+
 func (m *Mentor) initRole() {
 	_, m.err = m.engine.Context(m.ctx).Insert(roles)
 }
@@ -192,3 +209,15 @@ func (m *Mentor) initSiteInfoUsersConfig() {
 		Status:  1,
 	})
 }
+
+func (m *Mentor) initSiteInfoPrivilegeRank() {
+	privilegeRankData := map[string]interface{}{
+		"level": schema.PrivilegeLevel2,
+	}
+	privilegeRankDataBytes, _ := json.Marshal(privilegeRankData)
+	_, m.err = m.engine.Context(m.ctx).Insert(&entity.SiteInfo{
+		Type:    "privileges",
+		Content: string(privilegeRankDataBytes),
+		Status:  1,
+	})
+}

programming_language: Go
filename: init_data.go
change_type: ModificationType.MODIFY
diff: @@ -232,7 +232,7 @@ var (
 		{ID: 48, Key: "rank.comment.edit", Value: `-1`},
 		{ID: 49, Key: "rank.comment.delete", Value: `-1`},
 		{ID: 50, Key: "rank.report.add", Value: `1`},
-		{ID: 51, Key: "rank.tag.add", Value: `1`},
+		{ID: 51, Key: "rank.tag.add", Value: `1500`},
 		{ID: 52, Key: "rank.tag.edit", Value: `100`},
 		{ID: 53, Key: "rank.tag.delete", Value: `-1`},
 		{ID: 54, Key: "rank.tag.synonym", Value: `20000`},

programming_language: Go
filename: v3.go
change_type: ModificationType.MODIFY
diff: @@ -117,7 +117,7 @@ ON "question" (
 		{ID: 48, Key: "rank.comment.edit", Value: `-1`},
 		{ID: 49, Key: "rank.comment.delete", Value: `-1`},
 		{ID: 50, Key: "rank.report.add", Value: `1`},
-		{ID: 51, Key: "rank.tag.add", Value: `1`},
+		{ID: 51, Key: "rank.tag.add", Value: `1500`},
 		{ID: 52, Key: "rank.tag.edit", Value: `100`},
 		{ID: 53, Key: "rank.tag.delete", Value: `-1`},
 		{ID: 54, Key: "rank.tag.synonym", Value: `20000`},

programming_language: Go
filename: siteinfo_schema.go
change_type: ModificationType.MODIFY
diff: @@ -265,6 +265,16 @@ const (
 )
 
 type PrivilegeLevel int
+type PrivilegeOptions []*PrivilegeOption
+
+func (p PrivilegeOptions) Choose(level PrivilegeLevel) (option *PrivilegeOption) {
+	for _, op := range p {
+		if op.Level == level {
+			return op
+		}
+	}
+	return nil
+}
 
 // GetPrivilegesConfigResp get privileges config response
 type GetPrivilegesConfigResp struct {
@@ -285,7 +295,7 @@ type UpdatePrivilegesConfigReq struct {
 }
 
 var (
-	DefaultPrivilegeOptions      []*PrivilegeOption
+	DefaultPrivilegeOptions      PrivilegeOptions
 	privilegeOptionsLevelMapping = map[string][]int{
 		constant.RankQuestionAddKey:               {1, 1, 1},
 		constant.RankAnswerAddKey:                 {1, 1, 1},

programming_language: Go
filename: siteinfo_service.go
change_type: ModificationType.MODIFY
diff: @@ -322,13 +322,7 @@ func (s *SiteInfoService) translatePrivilegeOptions(ctx context.Context) (option
 }
 
 func (s *SiteInfoService) UpdatePrivilegesConfig(ctx context.Context, req *schema.UpdatePrivilegesConfigReq) (err error) {
-	var chooseOption *schema.PrivilegeOption
-	for _, option := range schema.DefaultPrivilegeOptions {
-		if option.Level == req.Level {
-			chooseOption = option
-			break
-		}
-	}
+	chooseOption := schema.DefaultPrivilegeOptions.Choose(req.Level)
 	if chooseOption == nil {
 		return nil
 	}

programming_language: Go