Hey Chuck, Gregory,<br><br>I've also tested the patch. It successfully secures the data, but it also silently removes the non editable contacts from contact lists as the list is viewed. Are you or are you not supposed to be able to add contacts from one
address book to a contact list in another address book? If not then users should also no longer be able to add contacts to contact lists from other address books.<br><br>Regards,<br><br>Peter Paul<br><br><div class="gmail_quote">
On Feb 7, 2008 2:37 AM, Gregory Colpart <<a href="mailto:reg@evolix.fr" target="_blank">reg@evolix.fr</a>> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Hi Chuck,<br><br>On Tue, Feb 05, 2008 at 03:25:10PM -0500, Chuck Hagenbuch wrote:<br>> Hi Gregory.<br>
><br>> Can you please test this patch on Turba 2.1.x?<br>><br>> I have a more comprehensive update for Turba 2.2.x and HEAD which<br>> cleans up the _read() function's API a bit more but has the same<br>
> effect. In my tests it denies access properly now.<br>><br>> Also, if you're curious: the issue is that you can access other user's<br>> contacts in the same database table ("source") by specifying your own<br>
> source id in the URL, but a contact id of another user's contact. I<br>> can't reproduce or find any issues other than that - can you confirm?<br>><br>> Thanks,<br>> -chuck<br>><br>><br>> Index: lib/Driver/sql.php<br>
> ===================================================================<br>> RCS file: /repository/turba/lib/Driver/sql.php,v<br>> retrieving revision <a href="http://1.59.10.17" target="_blank">1.59.10.17</a><br>
> diff -u -r1.59.10.17 sql.php<br>
> --- lib/Driver/sql.php 30 Nov 2006 21:33:47 -0000 <a href="http://1.59.10.17" target="_blank">1.59.10.17</a><br>> +++ lib/Driver/sql.php 5 Feb 2008 20:35:43 -0000<br>> @@ -182,6 +182,15 @@<br>
> $where = $criteria . ' = ?';<br>> $values[] = $this->_convertToDriver($id);<br>> }<br>> + if (isset($this->map['__owner'])) {<br>> + if ($this->usingShares) {<br>
> + $owner = $this->share->get('uid');<br>> + } else {<br>> + $owner = Auth::getAuth();<br>> + }<br>> + $where .= ' AND ' . $this->map['__owner'] . ' = ?';<br>
> + $values[] = $this->_convertToDriver($owner);<br>> + }<br>> if (!empty($this->_params['filter'])) {<br>> $where .= ' AND ' . $this->_params['filter'];<br>
> }<br>><br><br>I test your patch with success. I have now a "no results" message<br>when I try to edit a contact owned by a different user.<br><br>(Note: I Cc: Debian BTS because it's an unembargoed bug ;)<br>
<br>Regards,<br>--<br>Gregory Colpart <<a href="mailto:reg@evolix.fr" target="_blank">reg@evolix.fr</a>> GnuPG:1024D/C1027A0E<br>Evolix - Informatique et Logiciels Libres <a href="http://www.evolix.fr/" target="_blank">http://www.evolix.fr/</a><br>
<font color="#888888"><br><br><br>--<br>To unsubscribe, send mail to <a href="mailto:464058-unsubscribe@bugs.debian.org" target="_blank">464058-unsubscribe@bugs.debian.org</a>.<br></font></blockquote></div><br>