Redact invisible subteams from members and mugshots listings

[Simon Quigley]

I was curious, so I wanted to take a peek at the members of https://launchpad.net/~sso-2f-testers

I don't have access to view members here: https://launchpad.net/~sso-2f-testers/+members

But I can view all of the mugshots, thus getting a complete list (eventually) here: https://launchpad.net/~sso-2f-testers/+mugshots

I applied to be a member of the team but I am not currently one.

[Colin Watson (cjwatson)]

This is actually just a bug in the +members page. It isn't a security bug because its overall effect is to forbid access to some information that ought to be permitted, rather than the other way round.

The team is public, so its membership list is meant to be public too; but the +members page shows the list of proposed memberships as well, and in this case that includes a private team on which you don't have the LimitedView permission needed to get the displayname attribute, so it returns an Unauthorized response. There are other cases of this that seem to be legitimate, so we should probably redact such subteams from the members listings rather than trying to render them and hitting Unauthorized. (Note that users who are themselves members of such a superteam get the LimitedView permission on the subteam so that they can at least see that the membership exists, so this redaction wouldn't stop team members from knowing about the membership.)

There's a similar bug in +mugshots, although the details are different: if a team has a subteam as a member on which you don't have the View permission (not LimitedView this time), then +mugshots on the superteam will return an Unauthorized response due to trying to get the mugshotID attribute of the subteam.

[Robert Collins (lifeless)]

Huh, I've clearly paged a lot out, since private teams in public teams isn't making sense to my head now.
Teams with private membership in public teams - sure. But an invisible way to grant access to bugs etc... hmmm

[Colin Watson (cjwatson)]

That was my initial reaction, but since the LimitedView security adapter for teams arranges that members of superteams can see that the subteams exist, I think it's not quite as bad as all that.