Andreas/wekan
1
0
Fork 0
mirror of https://github.com/wekan/wekan.git synced 2026-01-23 17:56:09 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Security Fix 13: LinkedBoardActivitiesBleed.

Browse source 
Thanks to [Joshua Rogers](https://joshua.hu) of [Aisle Research](https://aisle.com) and xet7.
This commit is contained in:
Lauri Ojansivu 2026-01-18 20:13:25 +02:00
parent 4ce181d172
commit 91a936e07d
1 changed files with 24 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

47
server/publications/activities.js
View file

@ -21,37 +21,38 @@ Meteor.publish('activities', function(kind, id, limit, showActivities) {
return this.ready();
}
// Check user permissions - only BoardAdmin can view activities
if (this.userId) {
const user = ReactiveCache.getUser(this.userId);
const board = ReactiveCache.getBoard(id);
if (user && board) {
// Find user membership in board
const membership = board.members.find(m => m.userId === this.userId);
// Only BoardAdmin can view activities
if (!membership || !membership.isAdmin) {
return this.ready();
}
} else {
// If board or user not found, deny
return this.ready();
}
} else {
// If not logged in, deny
if (!this.userId) {
return this.ready();
}
// Get linkedBoard
let linkedElmtId = [id];
if (kind == 'board') {
let board;
if (kind === 'board') {
board = ReactiveCache.getBoard(id);
if (!board || !board.isVisibleBy(this.userId)) {
return this.ready();
}
// Get linked boards, but only those visible to the user
ReactiveCache.getCards({
"type": "cardType-linkedBoard",
"boardId": id}
).forEach(card => {
"boardId": id
}).forEach(card => {
const linkedBoard = ReactiveCache.getBoard(card.linkedId);
if (linkedBoard && linkedBoard.isVisibleBy(this.userId)) {
linkedElmtId.push(card.linkedId);
}
});
} else if (kind === 'card') {
const card = ReactiveCache.getCard(id);
if (!card) {
return this.ready();
}
board = ReactiveCache.getBoard(card.boardId);
if (!board || !board.isVisibleBy(this.userId)) {
return this.ready();
}
}
const selector = showActivities