Security: If you have export permissions in any module, you can export Any data from any module

If you have export permissions in any module, you can export all users to CSV as a regular user.

Steps required?

Without steps to reproduce issue report is not complete.

Title changed from Security: If you have export permissions in any module, you can export all users to CSV as a regular user. to Security: If you have export permissions in any module, you can export Any data from any module

@prasad following are steps to reproduce:

1. Login as non admin user

2. Go to any module where user has Export option

3. Click on Export option > select Export all data

4. Inspect the Element in Dev tool or similar

5. Change the hidden input source_module value to Users, like below:

6. Click on export

The fact this happens is because in ExportData function the parameter used to decide the module from which data has to be exported is source_module and there is no check for permissions on that.

In the checkpermission function, we check for the "module" parameter, but the module from which data has to be exported is "source_module".

Note: it is not just Users, you can change the source_module to any other module even if the current user does not have permissions for that module. And it will export data for that module.

thanks for the details.

Just a suggestion, instead of building a database query, can not we use the webservices query operation?

https://code.vtiger.com/vtiger/vtigercrm/blob/master/modules/Vtiger/actions/ExportData.php#L46

mentioned in merge request !361 (merged)

Status changed to closed by commit 05ce2258

Milestone changed to 7.2.0