New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security: No authorisation checks in download.php #8

Open

mudrd8mz opened this issue Feb 11, 2021 · 0 comments

mudrd8mz commented Feb 11, 2021

The download.php file only checks that the user is logged in - as a real user or a guest.

There are no authorisation and authentication check in the file.

As a result, anybody who can log in as a guest on the site can visit addresses like

https://server.url/moodle/local/edwiserreports/download.php?type=csv&block=inactiveusersblock&filter=weekly&cohortid=0&region=block

and obtain sensitive personal user data.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment