Fix security issue: Unexpected access to any tasks from a shared public board

2016-03-04 22:06:55 -05:00
parent a7f3e3bec5
commit f9f5d7188b
2 changed files with 10 additions and 2 deletions
--- a/app/Controller/Task.php
+++ b/app/Controller/Task.php
@@ -23,13 +23,17 @@ class Task extends Base

        // Token verification
        if (empty($project)) {
-            $this->forbidden(true);
+            return $this->forbidden(true);
        }

        $task = $this->taskFinder->getDetails($this->request->getIntegerParam('task_id'));

        if (empty($task)) {
-            $this->notfound(true);
+            return $this->notfound(true);
+        }
+
+        if ($task['project_id'] != $project['id']) {
+            return $this->forbidden(true);
        }

        $this->response->html($this->helper->layout->app('task/public', array(