API leaks user info

SoLux

What I was doing when the problem occurred:
I was working on some things using the API, and realized I was logged out, so I realized "Huh, this shouldn't be working.."

All the information I gathered while troubleshooting:
/api/users does say permission error but
/api/users/1 and so on does not.
so anyone that is not logged in or logged in without the permission can basicly get info about a user

Kyrne

SoLux This is expected. If you visit https://discuss.flarum.org/api/users/1 you will see that it works. You get this:

{"data":{"type":"users","id":"1","attributes":{"username":"Toby","avatarUrl":"https:\/\/discuss.flarum.org\/assets\/avatars\/yzejjqriqrwntpab.jpg","bio":"Flarum founder and lead developer. http:\/\/twitter.com\/tobscure","joinTime":"2014-11-19T23:47:00+00:00","discussionsCount":57,"commentsCount":1144,"canEdit":false,"canDelete":false,"lastSeenTime":"2017-09-14T05:11:37+00:00","canSuspend":false},"relationships":{"groups":{"data":[{"type":"groups","id":"1"}]}}},"included":[{"type":"groups","id":"1","attributes":{"nameSingular":"Admin","namePlural":"Admins","color":"#B72A2A","icon":"wrench"}}]}

If you take a look at the data, you will notice that it is data that is already publicly available through the forum, such as the user's username. If you were to be logged in as an admin, you would see much more info, such as the user's email.

Franz

Hmm, we could think about using non-incremental unique keys for user IDs... that way, it would not be possible to get information about users (especially those who have never posted) just by incrementing a number in the URL.

SoLux On the other hand, which of the information in Kyrne do you think should not be exposed?

Ralkage

What version of Flarum are you using? Beta 6? Beta 7? Please give us more information so we can assist you better.

SoLux

I am using Beta 7

SoLux

So for what reason does api/users/ need a permission then?
Anyone could make a for loop and just increment the user id to get everything that
api/users/ would have

Kyrne

SoLux The permission viewUserList

Ralkage

I did notice that setting viewUserList to "Everyone" does not allow guests to view the user list via API GET or just /api/users. I have always assumed that "Everyone" included gusts as well? @Kyrne Some insight if possible since we are on this topic.

It is returning:

{ "errors": [ { "status": "404", "code": "resource_not_found" } ] }
Even when viewUserList is set to "Everyone".

Kyrne

Ralkage everyone should be everyone, as users means registered users.

SoLux

That would only mean registered users, I think otherwise it would show up with Google perhaps?
As it'd change every time someone registers.

Ralkage

@Kyrne @SoLux Everyone would include "Guests" as well because viewDiscussions works as intended. The bug I am pointing out can be explained as so:

I am Flarum Administrator, I want to hide my forum discussions from the public and only allow registered users to see them. I go into my Admin CP, set "View discussions" in the permissions section to "Members" (aka Registered Users) and staff only. To test, I hit the API and call /api/discussions while my header includes my Authentication token that I generated to test this permission. This returns data successfully. I now revoke/remove my Authentication token, try a GET request again and it returns:

{ "links": { "first": "http://reflar.dev/api/discussions" }, "data": [] }
This works as intended and in reverse as well.

This, however, does not work the same for the "viewUserList" permission. It completely ignores the fact that I set this permission to "Everyone" as I did with "viewDiscussions".

Pollux

Ralkage It completely ignores the fact that I set this permission to "Everyone" as I did with "viewDiscussions".

I guess you mean set this permission to "Members"?

Ralkage

Pollux

The assumption is that when viewUserList is set to "Everyone", me, as the guest who just landed on this site can access the member list via API. It is still acting as if the permission change did not even occur. I consider this a functionality bug.

Pollux

I still don't get what you want, respectively what is not working as you would expect.

Ralkage The assumption is that when viewUserList is set to "Everyone", me, as the guest who just landed on this site can access the member list via API.

That's what I would expect too (and that's exactly what's happening in my forum). The discussions are hidden from guests, the user list is not, both in accordance with your settings. What would you expect.

Ralkage

Pollux It's working the complete opposite for me as even if I set it visible for "Guests", they still can't view the user list. This is supposed to be possible with the viewUserList permission addition in Beta 7. I set the permission to "Everyone" and guests can view the user list, that is supposed to happen as it behaves the same with viewDiscussions with the similar setting in place. Your issue may be isolated from mine, but we did manage to stumble into another one lol.

Do you have any 3rd party extensions currently installed?

Pollux

Ralkage Do you have any 3rd party extensions currently installed?

Yes, I use Flagrow User Directory (version 0.1.0) and it's working fine.

Ralkage we did manage to stumble into another one lol.

That's how it looks like. ?

Ralkage

Pollux That may be your issue right there, have you tried disabling that package, clearing your Flarum cache as well as browser cache? Two different permissions, one built into core and one in Flagrow's User Directory extension, they could be clashing in some way.

The last update to User Directory was 4 months ago, before Beta 7 released.

Pollux

I can see clearly now ...

Having the User Directory extension enabled doesn't make a difference, I tried it with and without.

Im my experiments with your scenario I did however restrict the permission to view discussions only globaly, assuming that this would override settings for specific tags. That was may mistake.

If I also restrict the permission to view discussions for every tag that comes with its own rules, I can indeed observe, what you described, the api call to /api/users reveales an essentially empty json response.

Pollux

And yes, I do see this behaviour as a bug too.

datitisev

In my testing, everything has worked just fine. flarum/core1245 (comment)
Not sure why it would return an empty array, as that code wasn't changed.
And yes, Everyone includes guests, for members there is a Members option.