Security: mailing-list address actions are GET links without CSRF token, and mailing progress needs no login

Open
  • Is something wrong?
#553 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
1-2 days
Newbie friendliness
54/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
php
Domain
authentication, backend, security

Research direction

Start in system/datatypes/mailinglist.php at the dispatch around lines 118–124 and inspect addressesView(), the three address actions, and mailingProgressAction() around line 1241. Compare the action links and handlers with the command flow that uses makeAction() and the isUser() check. The issue is done when the address actions require a CSRF-protected POST and mailing progress requires login.

Written by the indexing model from the issue text.

Description

Impact: Low Level: Moderate Pagetype: Mailinglist Privacy GDPR AVG Type: Bug Value: Security

Summary. The address list of a mailing list offers the administrator three actions as plain links with the e-mail address in the query string: …/remind?email=… (sends a confirmation mail again), …/delete?email=… (removes a pending address) and …/unsubscribe_by_admin?email=… (ends a subscription). They are views, handled on GET, without the CSRF token that Hypha's commands carry. A page elsewhere that makes a logged-in administrator open such a link (a top-level navigation is enough; session cookies without SameSite=Strict are sent along) removes or unsubscribes an address or sends a reminder mail on the administrator's behalf.

Separately, the progress endpoint of a mailing (POST …/mails/<id> with command=progress) has no login check: anyone who knows or guesses a mailing id gets the status of that mailing, also of a draft, and the number of confirmed subscribers.

Severity: Low. It needs a logged-in administrator and knowledge of the address; it changes subscriptions but exposes no personal data. The subscriber count is minor.

Affected code (main, d97ab7b), system/datatypes/mailinglist.php: the dispatch at lines 118-122, remindAction(), deleteAddressAction(), unsubscribeByAdminAction(); the links built in addressesView(); mailingProgressAction() (line 1241).

Suggested fix. Turn the three actions into commands posted with the form's CSRF token (makeAction(…, 'remind', $email), handled as [PATH_ADDRESSES, 'remind'] etc.), and add the isUser() check to mailingProgressAction(). Related: #420 (a failed CSRF check does not stop datatype commands).

Dominant language
JavaScript
Stars
5
Forks
9
Avg merge
18h 49m
Merged PRs (30d)
13

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from PlanBCode/hypha

All issues in PlanBCode/hypha

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.