Export: Authentication

- ExportServletHelper: improved user & role checking for the encoded queries
- QueryEncoderBackend: always attach user & role in the encoded query
- ACR Submit: include role in the export URL

Author: tomas-muller

JavaSource/org/unitime/timetable/events/QueryEncoderBackend.java

@@ -43,6 +43,7 @@
 import org.unitime.timetable.gwt.shared.EventInterface.EncodeQueryRpcRequest;
 import org.unitime.timetable.gwt.shared.EventInterface.EncodeQueryRpcResponse;
 import org.unitime.timetable.model.HashedQuery;
+import org.unitime.timetable.model.Roles;
 import org.unitime.timetable.model.dao.HashedQueryDAO;
 import org.unitime.timetable.security.SessionContext;
 
@@ -55,8 +56,8 @@ public class QueryEncoderBackend implements GwtRpcImplementation<EncodeQueryRpcR
 	@Override
 	public EncodeQueryRpcResponse execute(EncodeQueryRpcRequest request, SessionContext context) {
 		String query = request.getQuery() + 
-				(context.getUser() == null ? "" : "&user=" + context.getUser().getExternalUserId() +
-				(context.getUser() == null || context.getUser().getCurrentAuthority() == null ? "" : "&role=" + context.getUser().getCurrentAuthority().getRole()));
+				(context.getUser() == null ? "&user=" : "&user=" + context.getUser().getExternalUserId() +
+				(context.getUser() == null || context.getUser().getCurrentAuthority() == null ? "&role=" + Roles.ROLE_ANONYMOUS : "&role=" + context.getUser().getCurrentAuthority().getRole()));
 		if (request.isHash() && ApplicationProperty.UrlEncoderHashQueryWhenAsked.isTrue()) {
 			return new EncodeQueryRpcResponse(encode(query), hash(query));
 		} else {

JavaSource/org/unitime/timetable/export/ExportServletHelper.java

@@ -39,6 +39,7 @@
 import org.unitime.timetable.api.ApiToken;
 import org.unitime.timetable.defaults.ApplicationProperty;
 import org.unitime.timetable.events.QueryEncoderBackend;
+import org.unitime.timetable.model.Roles;
 import org.unitime.timetable.model.dao.SessionDAO;
 import org.unitime.timetable.security.SessionContext;
 import org.unitime.timetable.security.UserAuthority;
@@ -77,9 +78,11 @@ public ExportServletHelper(HttpServletRequest request, HttpServletResponse respo
 				uc = ((ApiToken)SpringApplicationContextHolder.getBean("apiToken")).getContext(getParameter("token"));
 				if (uc != null) iContext = new CustomExportContext(request.getSession(), uc);
 			} else if (isRequestEncoded()) {
-				String user = getParameter("user");
-				if (user != null)
-					uc = new UniTimeUserContext(user, null, null, null);
+				String[] user = getParameterValues("user");
+				String[] role = getParameterValues("role");
+				if (user != null && user.length == 1 && user[0] != null && !user[0].isEmpty() &&
+					role != null && role.length == 1 && role[0] != null && !role[0].isEmpty() && !Roles.ROLE_ANONYMOUS.equals(role[0]))
+					uc = new UniTimeUserContext(user[0], null, null, null);
 			}
 			if (uc != null) {
 	    		String role = getParameter("role");

JavaSource/org/unitime/timetable/onlinesectioning/advisors/AdvisorCourseRequestsSubmit.java

@@ -82,7 +82,7 @@ public AdvisorCourseRequestSubmission execute(OnlineSectioningServer server, Onl
 		try {
 			AdvisorCourseRequestSubmission ret = new AdvisorCourseRequestSubmission();
 			ret.setName("crf-" + server.getAcademicSession().getTerm() + server.getAcademicSession().getYear() + "-" + getDetails().getStudentName().replaceAll("[&$\\+,/:;=\\?@<>\\[\\]\\{\\}\\|\\^\\~%#`\\t\\s\\n\\r \\\\]", "") + "-" + getDetails().getStudentExternalId());
-			ret.setLink("export?q=" + QueryEncoderBackend.encode("output=acrf.pdf&sid=" + server.getAcademicSession().getUniqueId() + "&user=" + helper.getUser().getExternalId() + "&id=" + getDetails().getStudentExternalId()));
+			ret.setLink("export?q=" + QueryEncoderBackend.encode("output=acrf.pdf&sid=" + server.getAcademicSession().getUniqueId() + "&user=" + helper.getUser().getExternalId() + "&role=Advisor&id=" + getDetails().getStudentExternalId()));
 
 			OnlineSectioningLog.Action.Builder action = helper.getAction();
 			action.setStudent(OnlineSectioningLog.Entity.newBuilder()

WebContent/help/Release-Notes.xml

@@ -37,6 +37,15 @@
 			</description>
 		</item>
 	</category>
+	<category>
+		<title>Administration</title>
+		<item>
+			<name>Export: Encrypted URLs</name>
+			<description>
+				<line>Fixed a potential vulnerability problem with encrypted export URLs, allowing an attacker to inject a wrong user ID.</line>
+			</description>
+		</item>
+	</category>
 </release>
 
 <release>