Discussed in <a class="issue-link js-issue-link" data-error-text="Failed to load titl

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

Authorization Token allows action without login,about lycheeorg/lychee

ildyria commented on August 19, 2024

@agademer

Could you please double check your finding? Especially that:

users have may_upload=0
users do not have upload rights to root directory
users do not have edit rights to shared directory

Lychee/app/Http/Requests/Photo/AddPhotoRequest.php

Lines 13 to 16 in 57e3503

    
           class AddPhotoRequest extends BaseApiRequest implements HasAbstractAlbum 
        
           { 
        
           	use HasAbstractAlbumTrait; 
        
           	use AuthorizeCanEditAlbumTrait;

Ensures the Authorization.

Lychee/app/Http/Requests/Traits/Authorize/AuthorizeCanEditAlbumTrait.php

Lines 13 to 20 in 57e3503

    
           trait AuthorizeCanEditAlbumTrait 
        
           { 
        
           	/** 
        
           	 * {@inheritDoc} 
        
           	 */ 
        
           	public function authorize(): bool 
        
           	{ 
        
           		return Gate::check(AlbumPolicy::CAN_EDIT, [AbstractAlbum::class, $this->album]);

This calls the policy:

Lychee/app/Policies/AlbumPolicy.php

Lines 223 to 236 in 57e3503

    
           public function canEdit(User $user, AbstractAlbum|null $album): bool 
        
           { 
        
           	// The root album and smart albums get a pass 
        
           	if ($album === null || $album instanceof BaseSmartAlbum) { 
        
           		return $user->may_upload; 
        
           	} 
        
           	if ($album instanceof BaseAlbum) { 
        
           		return $this->isOwner($user, $album) || 
        
           			$album->current_user_permissions()?->grants_edit === true || 
        
           			$album->public_permissions()?->grants_edit === true; 
        
           	} 
        
           	return false;

I don't see any error in the code or I am missing an edge case.
Only thing I could think of is that the token would be giving admin perm instead of user perm which would be seriously worrisome.

from lychee.

agademer commented on August 19, 2024

Hi Benoit : Fresh install of lychee with docker 1/ User without upload right [image: image.png] curl --request POST --url https://MYURL/api/Album::add --header 'Accept: application/json' --header 'Content-Type: application/json' --data '{ "parent_id":"", "title": "agademer_public" }' --header 'Authorization: Rq-fBwVuO1AgAdpjGLW8Xw==' { "message": "Insufficient privileges", "exception": "UnauthorizedException" } curl --request POST --url https://MYURL/api/Photo::add --header 'Accept: application/json' --header 'Content-Type: multipart/form-data' --header 'Authorization: Rq-fBwVuO1AgAdpjGLW8Xw==' --form ***@***.*** --form albumID="" { "message": "Insufficient privileges", "exception": "UnauthorizedException" } 2/ Give the user upload right 3/ The user create an album 4/ Remove the user upload right $ curl --request POST --url https://MYURL/api/Photo::add --header 'Accept: application/json' --header 'Content-Type: multipart/form-data' --header 'Authorization: Rq-fBwVuO1AgAdpjGLW8Xw==' --form ***@***.*** --form albumID="hK4BrZx1Jb3ZJO8OZ0NMNLeo" {"id":"v2locTGpD1DePOc01rnW0QfS","album_id":"hK4BrZx1Jb3ZJO8OZ0NMNLeo","altitude":null,"aperture":null,"checksum":"c755f9d5b0261713154657767de4a6ce4c3a7198","created_at":"2024-02-28T16:28:00+01:00","description":null,"focal":null,"img_direction":null,"is_starred":false,"iso":null,"latitude":null,"lens":null,"license":"none","live_photo_checksum":null,"live_photo_content_id":null,"live_photo_url":null,"location":null,"longitude":null,"make":null,"model":null,"original_checksum":"c755f9d5b0261713154657767de4a6ce4c3a7198","shutter":null,"size_variants":{"medium":null,"medium2x":null,"original":null,"small":null,"small2x":null,"thumb":null,"thumb2x":null},"tags":[],"taken_at":null,"taken_at_orig_tz":null,"title":"9277d17c8384510afda0691d7c1e","type":"image\/jpeg","updated_at":"2024-02-28T16:28:00+01:00","rights":{"can_edit":true,"can_download":true,"can_access_full_photo":true},"next_photo_id":null,"previous_photo_id":null,"preformatted":{"created_at":"Feb 28, 2024, 4:28:00 PM Europe\/Paris","taken_at":null,"date_overlay":"Feb 28, 2024, 4:28:00 PM Europe\/Paris","shutter":"","aperture":"","iso":"ISO ","lens":"","duration":"0s","fps":" fps","filesize":"0.00 B","resolution":" x ","latitude":null,"longitude":null,"altitude":"0m","license":"","description":""},"precomputed":{"is_video":false,"is_raw":false,"is_livephoto":false,"is_camera_date":false,"has_exif":false,"has_location":false}} *So the problem occurs ONLY if the user had previously the upload right in order to create an album.* *But removing *him* upload privilege won't impede him to continue uploading in albums already existing.* Hope this helps, Kind regards,

…

On Tue, Feb 27, 2024 at 9:55 AM Benoît Viguier ***@***.***> wrote: @agademer <https://github.com/agademer> Could you please double check your finding? Especially that: - users have may_upload=0 - users do not have upload rights to root directory - users do not have edit rights to shared directory https://github.com/LycheeOrg/Lychee/blob/57e35039e232fd0ff5aa755ddb3b70a6f4d2002a/app/Http/Requests/Photo/AddPhotoRequest.php#L13-L16 Ensures the Authorization. https://github.com/LycheeOrg/Lychee/blob/57e35039e232fd0ff5aa755ddb3b70a6f4d2002a/app/Http/Requests/Traits/Authorize/AuthorizeCanEditAlbumTrait.php#L13-L20 This calls the policy: https://github.com/LycheeOrg/Lychee/blob/57e35039e232fd0ff5aa755ddb3b70a6f4d2002a/app/Policies/AlbumPolicy.php#L223-L236 I don't see any error in the code or I am missing an edge case. Only thing I could think of is that the token would be giving admin perm instead of user perm which would be seriously worrisome. — Reply to this email directly, view it on GitHub <#2302 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABZ27K7IHHVFKVBGHNZ3KWDYVWNRZAVCNFSM6AAAAABD2XDPO6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSNRWGA3DQMZXG4> . You are receiving this because you were mentioned.Message ID: ***@***.***>

from lychee.

ildyria commented on August 19, 2024

Hope this helps,

A LOT!
By creating the album the user get ownership, and as a result uploads rights:

$this->isOwner($user, $album)

Hummmm.

from lychee.

Authorization Token allows action without login about lychee HOT 3 CLOSED

Comments (3)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

	class AddPhotoRequest extends BaseApiRequest implements HasAbstractAlbum
	{
	use HasAbstractAlbumTrait;
	use AuthorizeCanEditAlbumTrait;

	trait AuthorizeCanEditAlbumTrait
	{
	/**
	* {@inheritDoc}
	*/
	public function authorize(): bool
	{
	return Gate::check(AlbumPolicy::CAN_EDIT, [AbstractAlbum::class, $this->album]);

	public function canEdit(User $user, AbstractAlbum\|null $album): bool
	{
	// The root album and smart albums get a pass
	if ($album === null \|\| $album instanceof BaseSmartAlbum) {
	return $user->may_upload;
	}

	if ($album instanceof BaseAlbum) {
	return $this->isOwner($user, $album) \|\|
	$album->current_user_permissions()?->grants_edit === true \|\|
	$album->public_permissions()?->grants_edit === true;
	}

	return false;