Mahara

Userlist element json script reveals user information

Bug #772160 reported by Richard Mansfield on 2011-04-28

258

This bug affects 1 person

	Status	Importance	Assigned to	Milestone
Mahara	Fix Released	High	Richard Mansfield	Mahara 1.4.0
1.2	Fix Released	High	Richard Mansfield	Mahara 1.2.9
1.3	Fix Released	High	Richard Mansfield	Mahara 1.3.6

Bug Description

The script json/usersearch.php, used by the 'userlist' pieform element to do user searches, should only return a list of user ids and names, but gives out more user information than it should, such as email addresses.

CVE References

2011-1404

Revision history for this message

Richard Mansfield (richard-mansfield) wrote on 2011-04-28:

Patch for 1.2, 1.3 and master Edit (869 bytes, text/plain)

Revision history for this message

Richard Mansfield (richard-mansfield) wrote on 2011-04-28:

Patch for 1.0 Edit (859 bytes, text/plain)

François Marier (fmarier) on 2011-05-10

visibility:

private → public

Richard Mansfield (richard-mansfield) on 2011-05-10

Changed in mahara:
status:	In Progress → Fix Committed

François Marier (fmarier) on 2011-06-14

Changed in mahara:
status:	Fix Committed → Fix Released

Report a bug

This report contains Public Security information

Everyone can see this security related information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Patches

Add patch

Remote bug watches

Bug watches keep track of this bug in other bug trackers.