From eafa700723b21015ca9e34a1e9bd013dffc4ce87 Mon Sep 17 00:00:00 2001 From: plegall Date: Wed, 27 Sep 2023 19:23:38 +0200 Subject: [PATCH] search: prevent using search id if the search uuid is available --- include/functions_search.inc.php | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/include/functions_search.inc.php b/include/functions_search.inc.php index f70fab46e..edf3409a3 100644 --- a/include/functions_search.inc.php +++ b/include/functions_search.inc.php @@ -44,6 +44,19 @@ SELECT * if (count($searches) > 0) { + // we don't want spies to be able to see the search rules of any prior search (performed + // by any user). We don't want them to be try index.php?/search/123 then index.php?/search/124 + // and so on. That's why we have implemented search_uuid with random characters. + // + // We also don't want to break old search urls with only the numeric id, so we only break if + // there is no uuid. + // + // We also don't want to die if we're in the API. + if (script_basename() != 'ws' and 'id = %u' == $clause_pattern and isset($searches[0]['search_uuid'])) + { + fatal_error('this search is not reachable with its id, need the search_uuid instead'); + } + return $searches[0]; }