Links to nonexistent tickets on Trac fail

[Mitar]

Links to nonexistent tickets on wiki fail with this plugin enabled. For example TracLinks wiki page fails with Ticket 944 does not exist. error if there is no 944 ticket on a system.

[Mitar]

patch

[Mitar]

I have made a patch for this bug.

And it is not just links on wiki but everywhere where it is possible to make links to tickets and Trac checks those links.

[Anders Kaseorg]

Hmm, I didn’t noticed this bug when I opened #7082. Please do not use this patch, as it opens a race condition where an unprivileged attacker may briefly have access to a sensitive ticket. Please use the patch in #7082 instead.

[Mitar]

Can you please explain the race condition?

[Anders Kaseorg]

This was part of my commit message:

(Allowing access to nonexistent tickets would lead to a dangerous race
condition when an attacker views a sensitive ticket just as it’s being
created.)

In particular, if a sensitive ticket is created between ​these two lines of trac.ticket.web_ui:

        req.perm('ticket', id, version).require('TICKET_VIEW')
        ticket = Ticket(self.env, id, version=version)

then the permission check will have succeeded and the ticket will be displayed to the attacker.

[Mitar]

Good catch.

[Mitar]

Hm. But does not your patch prevent users without SENSITIVE_VIEW permission to open a ticket?

[anonymous]

Replying to mitar:

Hm. But does not your patch prevent users without SENSITIVE_VIEW permission to open a ticket?

No, I just tested; users without SENSITIVE_VIEW permission are able to open a ticket just fine.

Now, if they open a _sensitive_ ticket, then they do not have permission to view the ticket they just opened, and they are mysteriously redirected back to the new ticket form with no indication that the ticket was successfully opened (even though it was). But that behavior is the same with your patch, my patch, or no patch. I’ll open a separate bug for that.

Also, since neither patch has been applied yet, I’m going to reopen this bug and resolve it as “duplicate”.

[Anders Kaseorg]

(Forgot to log in. That last comment was from me, of course.)