diff options
| -rw-r--r-- | ChangeLog | 4 | ||||
| -rw-r--r-- | app/Controller/Task.php | 8 |
2 files changed, 10 insertions, 2 deletions
@@ -5,6 +5,10 @@ Improvements: * Added support for HTTP header "X-Forwarded-Proto: https" +Security issues: + +* Access allowed to any tasks from the shared public board by changing the URL parameters + Version 1.0.26 -------------- diff --git a/app/Controller/Task.php b/app/Controller/Task.php index 5f35be55..56d222d0 100644 --- a/app/Controller/Task.php +++ b/app/Controller/Task.php @@ -23,13 +23,17 @@ class Task extends Base // Token verification if (empty($project)) { - $this->forbidden(true); + return $this->forbidden(true); } $task = $this->taskFinder->getDetails($this->request->getIntegerParam('task_id')); if (empty($task)) { - $this->notfound(true); + return $this->notfound(true); + } + + if ($task['project_id'] != $project['id']) { + return $this->forbidden(true); } $this->response->html($this->helper->layout->app('task/public', array( |