Visiting a user's page gives unauthorised, but breadcrumb shows full name

[Matt Giuca]

Is this an information disclosure problem? We aren't authorised to view the object, but this piece of information is shown anyway.

[Matt Giuca (mgiuca)]

From a discussion with dcoles earlier, I think we figured that this is not a bug we need to solve. The disclosure is minor, (just shows the user's nickname if you know their login). This is no worse than `finger`. I am marking this as In Progress as I'm going to investigate how easy it is to actually fix the bug, if desired. But we may end up just marking as Wont Fix.

[Matt Giuca (mgiuca)]

OK, there are three choices.

1. Consider seeing the nickname as NOT a disclosure vulnerability. Don't fix. Or,
2. Accept the following patch, which displays the nickname iff you have permission to view:
--- ivle/webapp/admin/breadcrumbs.py 2010-02-24 02:43:38 +0000
+++ ivle/webapp/admin/breadcrumbs.py 2010-02-24 03:13:11 +0000
@@ -37,7 +37,13 @@

     @property
     def text(self):
- return self.context.nick
+ perms = self.context.get_permissions(self.req.user, self.req.config)
+ # Show nickname iff current user has permission to view this user
+ # (Else, show just the login name)
+ if 'view' in perms:
+ return self.context.nick
+ else:
+ return self.context.login

     @property
     def extra_breadcrumbs_before(self):

3. ....

[Matt Giuca (mgiuca)]

3. Always display the nickname in the breadcrumb:
--- ivle/webapp/admin/breadcrumbs.py 2010-02-24 02:43:38 +0000
+++ ivle/webapp/admin/breadcrumbs.py 2010-02-24 03:08:24 +0000
@@ -37,7 +37,7 @@

     @property
     def text(self):
- return self.context.nick
+ return self.context.login

     @property
     def extra_breadcrumbs_before(self):

I vote number 2 -- I like breadcrumbs with the proper nickname, but I want to clean up any claim of a disclosure vulnerability. Maybe in the future we'll actually let users have a public page at ~login, and then we'll open it up again.

[Matt Giuca (mgiuca)]

On Will's approval, chose option #2 -- conditionally show the nickname iff the user has permission to view. Fixed in trunk r1684.

Note that if we make an open user page in the future, we won't have to revisit this bug, as presumably the "view" permission will be more open. That will automatically change the behaviour of the breadcrumb.