Mahara

Group member search json script reveals user information

Bug #772174 reported by Richard Mansfield on 2011-04-28

258

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	Mahara	Fix Released	High	Richard Mansfield	Mahara 1.4.0
	1.3	Fix Released	High	Richard Mansfield	Mahara 1.3.6

Bug Description

The script group/membersearchresults.php, should only return a list of user ids and names, but gives out more user information than it should, such as email addresses. Similar to bug #772160.

Only affects 1.3+. In previous versions the script was not used for the userlist pieform element & only returned html.

CVE References

2011-1404

Revision history for this message

Richard Mansfield (richard-mansfield) wrote on 2011-04-28:

Patch for 1.3 and master Edit (1.0 KiB, text/plain)

François Marier (fmarier) on 2011-05-10

visibility:

private → public

Richard Mansfield (richard-mansfield) on 2011-05-10

Changed in mahara:
status:	In Progress → Fix Committed

François Marier (fmarier) on 2011-06-14

Changed in mahara:
status:	Fix Committed → Fix Released

Report a bug

This report contains Public Security information

Everyone can see this security related information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Patches

Patch for 1.3 and master Edit

Add patch

Remote bug watches

Bug watches keep track of this bug in other bug trackers.