diff options
| author | Patrick Uiterwijk <puiterwijk@redhat.com> | 2015-08-18 16:26:50 +0200 |
|---|---|---|
| committer | Patrick Uiterwijk <puiterwijk@redhat.com> | 2015-08-21 15:45:00 +0200 |
| commit | 826e6339441546f596320f3d73304ab5f7c10de6 (patch) | |
| tree | 17d31678b56bac4dcce8b3a2e6c60d3e0ad5bbb4 /ipsilon | |
| parent | 5f591228346bd96561b693cae43b8f14e4c3b26d (diff) | |
| download | ipsilon-826e6339441546f596320f3d73304ab5f7c10de6.tar.gz ipsilon-826e6339441546f596320f3d73304ab5f7c10de6.tar.xz ipsilon-826e6339441546f596320f3d73304ab5f7c10de6.zip | |
Fix permission check on SP update
The permission check for owner was checking the wrong field,
which would make it possible for anyone to update the Service
Provider owner, making it possible for anyone to change the
SP owner, allowing anyone to change the SP name.
Fixes: CVE-2015-5217
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Rob Crittenden <rcritten@redhat.com>
Diffstat (limited to 'ipsilon')
| -rw-r--r-- | ipsilon/providers/saml2/admin.py | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/ipsilon/providers/saml2/admin.py b/ipsilon/providers/saml2/admin.py index 28ea19f..811af9f 100644 --- a/ipsilon/providers/saml2/admin.py +++ b/ipsilon/providers/saml2/admin.py @@ -192,8 +192,9 @@ class SPAdminPage(AdminPage): if (not self.user.is_admin and self.user.name != self.sp.owner): raise UnauthorizedUser("Unauthorized to set owner") - elif key in ['Owner', 'Default NameID', 'Allowed NameIDs', - 'Attribute Mapping', 'Allowed Attributes']: + elif key in ['User Owner', 'Default NameID', + 'Allowed NameIDs', 'Attribute Mapping', + 'Allowed Attributes']: if not self.user.is_admin: raise UnauthorizedUser( "Unauthorized to set %s" % key |