hhyo/Archery

A账号可以越权查看B账号的查询权限申请记录

Open

#2,308 opened on Sep 28, 2023

View on GitHubContributor guide
 (1 comment) (0 reactions) (0 assignees)Python (1,851 forks)batch import
area/auditenhancementgood first issuehelp wanted

Repository metrics

Stars
 (7,005 stars)
PR merge metrics
 (Avg merge 12d 20h) (11 merged PRs in 30d)

Description

重现步骤

1.管理员未给A账号分配可查询权限申请记录 2.A账号不仅可以看到自己申请的查询权限记录，还可以通过修改域名的方式，越权查看B账号的查询权限申请记录

预期外的结果

可以通过修改域名的方式......queryapplydetail/2/ 越权查看B账号的查询权限申请记录. 数字2可以随便改写

日志文本

No response

版本

1.9.1

部署方式

Docker

是否还有其他可以辅助定位问题的信息？比如数据库版本等

No response

Contributor guide

Research direction
Identify the view handler for `/queryapplydetail/<id>` and check if it verifies that the requesting user has permission to view the specified application record. The bug likely lies in missing ownership or permission checks.
Tech stack
python
Domain
backendsecurity
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
PythonWeb Security Basics
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60