Fine-grained REPORT_VIEW permissions not checked when displaying report

[turkanis@…]

I am trying to restrict access to sensitive reports using the AuthzPolicy. When I add an entry of the form

[report:27]
@administrators = REPORT_VIEW
* = ""

the report is correctly omitted for unprivileged users from the list of available reports at the URL /report.

However, if the unprivileged user types the URL /report/27 into his browser, he can view the report.

I was able to fix the problem with the attached patch against 0.11.4 that adds a permission check to report.py. I am a Trac novice so I may be barking up the wrong tree.

[turkanis@…]

Patch of ticket/report.py

[Christian Boos]

Replying to turkanis@…:

… I am a Trac novice so I may be barking up the wrong tree.

Not at all ;-) Thanks for the report and the patch, which I verified.

But there seem to be another, general, problem with permission error reporting when using Python 2.6, the red box normally containing the "xxx privileges are required to perform this operation on yyy" message is empty.

[Christian Boos]

Fix applied in r8286.

[Christian Boos]

Replying to cboos:

… another, general, problem with permission error reporting when using Python 2.6, the red box normally containing the "xxx privileges are required to perform this operation on yyy" message is empty.

And that one was fixed by [8287].

[kb@…]

The fix here only solved the issue for reports (report.py) but the same issue is still present for queries (query.py)

(Problem exists for Trac 1.0)

[kb@…]

Replying to kb@…:

The fix here only solved the issue for reports (report.py) but the same issue is still present for queries (query.py)

(Problem exists for Trac 1.0)

Sorry this isn't a proper patch, but a one line fix seems to solve the problem for me in query.py, I added this req.perm.require() line as the first line of the method display_html:

def display_html(self, req, query):
    req.perm.require('REPORT_VIEW', Resource('report', query.id))

Better place to fix this?

[Jun Omae]

Replying to kb@…:

The fix here only solved the issue for reports (report.py) but the same issue is still present for queries (query.py)

No. The query page requires TICKET_VIEW, not REPORT_VIEW.

[kb@…]

Replying to jomae:

Replying to kb@…:

The fix here only solved the issue for reports (report.py) but the same issue is still present for queries (query.py)

No. The query page requires TICKET_VIEW, not REPORT_VIEW.

The user shouldn't be allowed to run the report in the first place without REPORT_VIEW, regardless of which tickets are returned. (I'd reopen the ticket, but by no means intend to start a war, just being helpful, so I'll leave it closed. But there is a bug here, I promise.)

[Ryan J Ollos <ryan.j.ollos@…>]

Replying to kb@…:

The user shouldn't be allowed to run the report in the first place without REPORT_VIEW, regardless of which tickets are returned.

A query is not a report. In some cases a report is a saved query, which may be one source of your confusion. This is explained in TracQuery and TracReports. You may not like this, but the behavior is intentional and consistent throughout Trac, and therefore there is not bug here.