Page MenuHomePhabricator
Create Task
Maniphest T6724

Conduit allows non-users to be added to Conpherences
Closed, ResolvedPublic
Actions

Description

Via HackerOne. I don't think this has meaningful security impact, but you can add things like wiki pages as Conpherence members. We should probably provide some ConpherenceMessageableInterface and only permit objects which implement it to be added.

Revisions and Commits

Restricted Differential RevisionRestricted Diffusion Commit

Related Objects
Search...

Event Timeline

epriestley created this task.Dec 10 2014, 4:55 PM
epriestley raised the priority of this task from to Low.
epriestley updated the task description. (Show Details)
epriestley added a project: Conpherence.
epriestley added subscribers: epriestley, btrahan.
epriestley added a comment.Dec 10 2014, 5:08 PM

T5873 has some general discussion of insufficient validation in Conduit at present.

epriestley added a parent task: T5364: Conpherence v2 (Original Discussion).Jan 6 2015, 1:32 AM
chad moved this task from Backlog to v2 on the Conpherence board.Jan 22 2015, 9:23 PM
epriestley added a revision: Restricted Differential Revision.Mar 3 2015, 12:42 PM
epriestley closed this task as Resolved by committing Restricted Diffusion Commit.Mar 3 2015, 6:40 PM
epriestley added a commit: Restricted Diffusion Commit.
Phabricator · Built by Phacility