From d598054195219755381dc080111a6602d6adfc9e Mon Sep 17 00:00:00 2001 From: jvoisin Date: Tue, 14 Apr 2026 22:10:30 +0200 Subject: [PATCH] Fix an IDOR in kobo tokens Authenticated users shouldn't be able to generate/delete kobo auth tokens for other users if they're not admin. --- cps/kobo_auth.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/cps/kobo_auth.py b/cps/kobo_auth.py index ae9d1c12b..9559f4f3a 100644 --- a/cps/kobo_auth.py +++ b/cps/kobo_auth.py @@ -81,6 +81,8 @@ kobo_auth = Blueprint("kobo_auth", __name__, url_prefix="/kobo_auth") @kobo_auth.route("/generate_auth_token/") @user_login_required def generate_auth_token(user_id): + if current_user.id != user_id and not current_user.role_admin(): + abort(403) warning = False host_list = request.host.rsplit(':') if len(host_list) == 1: @@ -123,6 +125,8 @@ def generate_auth_token(user_id): @kobo_auth.route("/deleteauthtoken/", methods=["POST"]) @user_login_required def delete_auth_token(user_id): + if current_user.id != user_id and not current_user.role_admin(): + abort(403) # Invalidate any previously generated Kobo Auth token for this user ub.session.query(ub.RemoteAuthToken).filter(ub.RemoteAuthToken.user_id == user_id)\ .filter(ub.RemoteAuthToken.token_type==1).delete()