search

RotherOSS / FAQ

The FAQ/knowledge base.
0 stars 3 forks source link

Article title with no permission listed in CustomerFAQExplorer #11

Closed io-architect closed 2 years ago

io-architect commented 2 years ago

Hello all,

When using CustomerGroupSupport, customer user can see FAQ articles title without permission.

How to reproduce the issue:

  1. Enable "CustomerGroupSupport"

  2. Create customer company "COMPANY01" and "COMPANY02"

  3. Create customer user "cust01" -> "COMPANY01", "cust02" -> "COMPANY02"

  4. Create group "tech01" and "tech02"

  5. Assign COMPANY01 -> tech02, COMPANY02 -> tech02

  6. Create FAQ category TECH01(group tech01), TECH02(group tech02)

  7. Create FAQ article "FOR TECH01" in category TECH01 and "FOR TECH02" in category TECH02, with external

  8. Login customer.pl by cust01

  9. Visit "FAQ" page on customer interface, can look subcategories only "TECH01" ( is OK), but Latest Updated Articles, there are 2 FAQ article listed "FOR TECH 01" and "FOR TECH 02" ( "FOR TECH 02" is NG)

  10. Select FAQ artcile "FOR TECH 02", There are error "Insufficient Rights" (Message: No Permission!) (OK)

  11. Search article with keyword "TECH", there are article listed "FOR TECH 01" and "FOR TECH 02" ( "FOR TECH 02" is NG)

Tracing the code: When Jumping dashboard to CustomerFAQExplorer, there are no CategoryID and the module calls Kernel::System::FAQ::FAQSearch() without CategoryIDs parameter. Kernel::System::FAQSearch returns article list without permission check, module listed all articles without check.

Regards, Tomohisa Hirami

bschmalhofer commented 2 years ago

Hi @io-architect,

thanks for the detailed description and the pull request. The fix will included in the next release 10.0.6 of the FAQ package. I have already merged it in Github. I also made a small refactoring, so that CustomerCategorySearch() is called in only one code path, that covers both cases.

Best regards, Bernhard