Security hole in GeoNetwork search

[heikki]

When you craft a search request, such that it has a group as a parameter, the search results that are returned are just the metadata from that group, regardless whether you are allowed to see those.

To reproduce :

• login as admin
• create a group and note its id. Let's say its id is 3.
• create a metadata belonging to group 3. Verify it is only visible to users from group 3, and certainly not to group 'all'.
• logout
• craft a search request containing the group parameter. For example, in gn_search.js, add the line "pars += "&group=3";" to the "runSimpleSearch" function
• while still logged out, execute the search that incl. this group parameter.

The non-published metadata from group 3 are now shown in your search results.

[heikki]

okay, again, with better formatting of the ticket description:

When you craft a search request, such that it has a group as a parameter, the search results that are returned are just the metadata from that group, regardless whether you are allowed to see those.

To reproduce :

• login as admin

• create a group and note its id. Let's say its id is 3.

• create a metadata belonging to group 3. Verify it is only visible to users from group 3, and certainly not to group 'all'.

• logout

• craft a search request containing the group parameter. For example, in gn_search.js, add the line "pars += "&group=3";" to the "runSimpleSearch" function

• while still logged out, execute the search that incl. this group parameter.

The non-published metadata from group 3 are now shown in your search results.

[heikki]

Fixed by adding a check in LuceneSearcher such that an exception is thrown when the search request contains group(s) parameters, but they are not in the user's groups.

Check is omitted if you're logged in as an ADMINISTRATOR.