Hi all,

From the following video "Enforcing Security Part 1" at 2:23,

http://www.mojoportal.com/dev-series-25-enforcing-security-part-1.aspx

and related code

protected void Page_Load(object sender, EventArgs e)
{
LoadParams();

if (!UserCanEditModule(moduleId) || itemGuid==Guid.Empty)
{
SiteUtils.RedirectToAccessDeniedPage();
return;
}

...

}

private void LoadParams()

{

...

moduleId = WebUtils.ParseInt32FromQueryString("mid", moduleId);

...

}

It seems that it is quite easy to spoof the moduleId by modifying query string in the requesting URL.

Suppose a user has edit rights to an unrelated module on the web site, he/she can invoke Edit.aspx with edit.aspx?mid=xxx where xxx is the module that he/she has edit rights to.

Do I miss something?

Thanks!

dl

I traced the code a bit and found that the currentPage variable in UserCanEditModule is based on the query string too.

private static PageSettings LoadCurrentPage()
{
...

int pageID = WebUtils.ParseInt32FromQueryString("pageid", -1);

...

PageSettings currentPage = new PageSettings(siteSettings.SiteId, pageID);

...

}

suppose I have page and module that I have rights to, I can spoof the url with edit.aspx?pageid=yyy&mid=xxx.

The question I am asking is that there is no knowledge of page/module ID in the supporting page except from url. How can the page be secured via external data source (in this case the url).

dl

So I guess this is how thing should work in the Guestbook app.

The UserCanEditModule function will guarantee that the pageid and moduleid are valid and user has access to it. It is up to your application to make sure that the moduleId and itemGuid match as shown in the following code (which is missing in the tutorial).

private void Save()
{

GuestBook g = repository.Fetch(itemGuid);

if g.moduleId != this.moduleId)
{
SiteUtils.RedirectToAccessDeniedPage();
return;
}

g.Name = txtName.Text;
g.EmailAddress = txtEmailAddress.Text;
g.Location = txtLocation.Text;
g.WebSiteUrl = txtWebSiteUrl.Text;
g.Comment = txtComment.Text;

repository.Save(g);
}

Am I right?

dl