Headline
CVE-2023-38494: fix: 增加用户组接口的权限校验 · metersphere/metersphere@a23f75d
MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attackers. Version 2.10.4 LTS contains a patch for this issue.
@@ -1,8 +1,11 @@ package io.metersphere.controller;
import io.metersphere.base.domain.User; import io.metersphere.base.domain.UserGroup; import io.metersphere.commons.constants.OperLogConstants; import io.metersphere.commons.constants.OperLogModule; import io.metersphere.commons.constants.UserGroupConstants; import io.metersphere.commons.user.SessionUser; import io.metersphere.commons.utils.SessionUtils; import io.metersphere.dto.UserDTO; import io.metersphere.log.annotation.MsAuditLog; Expand All @@ -11,12 +14,10 @@ import io.metersphere.request.member.EditSeleniumServerRequest; import io.metersphere.request.member.QueryMemberRequest; import io.metersphere.service.BaseUserService; import jakarta.annotation.Resource; import org.springframework.web.bind.annotation.*;
import jakarta.annotation.Resource; import java.util.List; import java.util.Map; import java.util.Objects; import java.util.*;
@RestController @RequestMapping(“/user”) Expand All @@ -26,6 +27,13 @@ public class BaseUserController {
@GetMapping(“/ws/current/member/list”) public List<User> getCurrentWorkspaceMember() { SessionUser user = SessionUtils.getUser(); Optional<UserGroup> any = user.getUserGroups().stream() .filter(ug -> (ug.getSourceId().equals(SessionUtils.getCurrentWorkspaceId()) || ug.getGroupId().equals(UserGroupConstants.SUPER_GROUP))) .findAny(); if (any.isEmpty()) { return new ArrayList<>(); } QueryMemberRequest request = new QueryMemberRequest(); request.setWorkspaceId(SessionUtils.getCurrentWorkspaceId()); return baseUserService.getMemberList(request); Expand Down Expand Up @@ -56,6 +64,13 @@ public int updateCurrentUserPassword(@RequestBody EditPassWordRequest request) {
@GetMapping(“/project/member/list”) public List<User> getProjectMemberListAll() { SessionUser user = SessionUtils.getUser(); Optional<UserGroup> any = user.getUserGroups().stream() .filter(ug -> (ug.getSourceId().equals(SessionUtils.getCurrentProjectId()) || ug.getGroupId().equals(UserGroupConstants.SUPER_GROUP))) .findAny(); if (any.isEmpty()) { return new ArrayList<>(); } QueryMemberRequest request = new QueryMemberRequest(); request.setProjectId(SessionUtils.getCurrentProjectId()); return baseUserService.getProjectMemberList(request); Expand All @@ -68,6 +83,13 @@ public List<User> getProjectMemberOption() {
@GetMapping(“/project/member/{projectId}”) public List<User> getProjectMembers(@PathVariable String projectId) { SessionUser user = SessionUtils.getUser(); Optional<UserGroup> any = user.getUserGroups().stream() .filter(ug -> (ug.getSourceId().equals(projectId) || ug.getGroupId().equals(UserGroupConstants.SUPER_GROUP))) .findAny(); if (any.isEmpty()) { return new ArrayList<>(); } QueryMemberRequest request = new QueryMemberRequest(); request.setProjectId(projectId); return baseUserService.getProjectMemberList(request); Expand Down