HexBrain

Localize · Report #7921

Assigning a non-existing role to user causes exception when opening project page

Validstatus
3upvotes
19 Apr 2014disclosed

How it was found

Reproduction:

  • Create a new private project
  • Log in as another user and go the the newly create project page. Request access there.
  • Switch back to original user and check pending requests.
  • At this point I was able to assign a non-existing role (I changed the dropdown list and chose 10 as value). Grant user access then.
  • Log in again a the user that requested access. The dashboard indicates that the request was accepted.
  • Click on the project. The following error is given:

Fatal error: Uncaught exception 'Exception' with message 'Unknown role 10' in /var/www/vhosts/lvps178-77-99-228.dedicated.hosteurope.de/httpdocs_localize/classes/Repository.php:358 Stack trace: #0 /var/www/vhosts/lvps178-77-99-228.dedicated.hosteurope.de/httpdocs_localize/classes/UI.php(1136): RepositoryPermissions->isInvitationMissing() #1 /var/www/vhosts/lvps178-77-99-228.dedicated.hosteurope.de/httpdocs_localize/classes/UI.php(204): UI::getPage_Project(Array, Array) #2 /var/www/vhosts/lvps178-77-99-228.dedicated.hosteurope.de/httpdocs_localize/classes/UI.php(179): UI::findPage(6, Array, Array) #3 /var/www/vhosts/lvps178-77-99-228.dedicated.hosteurope.de/httpdocs_localize/index.php(158): UI::getPage(6) #4 {main} thrown in /var/www/vhosts/lvps178-77-99-228.dedicated.hosteurope.de/httpdocs_localize/classes/Repository.php on line 358

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original