Cytomine-ULiege / Cytomine-Web-UI

Cytomine-Web-UI is the graphical user interface for Cytomine. Our fork includes R&D experimental features. See @cytomine for official releases.
Apache License 2.0
5 stars 3 forks source link

Data breach when accessing annotations from similar annotations search #109

Closed bathienle closed 1 month ago

bathienle commented 1 month ago

Description

When clicking on an annotation found through the "similar annotations search," if the annotation belongs to a different project, it is incorrectly displayed within the current project instead of navigating to the correct project. This results in unauthorized access to annotations outside the current project, leading to a data breach.

Expected behaviour

When clicking on the annotation that is in another project, it should navigate to the correct project and display the annotation there.

Step to reproduce

Description of the steps to reproduce the bug.

  1. Perform a search using the "similar annotations search" feature.
  2. Click on an annotation that belongs to a different project.
  3. Observe that the annotation is displayed within the current project rather than navigating to the correct project.