phplist

NOTE:: Before reporting an issue, make sure you are running the latest version, currently 3.3.1


View Issue Details Jump to Notes ] Print ]
IDProjectCategoryView StatusDate SubmittedLast Update
0017801phplist applicationSubscriber Exportpublic27-08-15 17:0801-10-15 12:52
Reportersd3pk3 
PrioritynormalSeveritymajorReproducibilityalways
StatusresolvedResolutionfixed 
PlatformOSOS Version
Product Version3.0.12 
Target Versionnext patchFixed in Version3.2.1 
Summary0017801: Export subscriber with limited rights exports whole subscriber database
DescriptionIf you assign an admins with to just one list (with non-superadmin permission) but the permission to edit subscribers, he can go to "export subscribers" and export the whole subscriber database, not just his own list!
Steps To Reproduce- Create Admin with permission "edit subscribers"
- Create two lists with subscribers, list1 and list2
- Assign list1 to this admin
- go to section export and export database
- you will get the content of list1 and list2
Additional InformationHotfix: In my eyes, this is critical if you need a strict separation in between lists in terms of privacy/data protection. To fix this, I post on /lists/admin/export.php the following code:

#Restricted area, access only for superadmin

if (!$_SESSION['logindetails']['superuser']) {
  print $GLOBALS['I18N']->get('Sorry, this page can only be used by super admins');
  return;
}

I put this code in the beginning of the files right under:

<?php
require_once dirname(__FILE__).'/accesscheck.php';

To restrict the export section to superadmins only, you have to modify the file /lists/admin/export.php

Please note: This is not a real fix, ist just a hotfix which allows you to continue using the system and being fine in terms of privacy (if you need separated lists).
A real fix should just allow to export the assigned list(s), nothing more.
TagsNo tags attached.
Attached Files

- Relationships Relation Graph ] Dependency Graph ]

-  Notes
(0056671)
michiel (manager)
27-08-15 17:14


yes, good point


Copyright © 2000 - 2017 MantisBT Team
Powered by Mantis Bugtracker