{"action":"created","issue":{"url":"https://api.github.com/repos/UniversityofPortland/moodle-block_custom_course_menu/issues/15","repository_url":"https://api.github.com/repos/UniversityofPortland/moodle-block_custom_course_menu","labels_url":"https://api.github.com/repos/UniversityofPortland/moodle-block_custom_course_menu/issues/15/labels{/name}","comments_url":"https://api.github.com/repos/UniversityofPortland/moodle-block_custom_course_menu/issues/15/comments","events_url":"https://api.github.com/repos/UniversityofPortland/moodle-block_custom_course_menu/issues/15/events","html_url":"https://github.com/UniversityofPortland/moodle-block_custom_course_menu/issues/15","id":118386204,"number":15,"title":"Very weak access control","user":{"login":"mudrd8mz","id":85831,"avatar_url":"https://avatars.githubusercontent.com/u/85831?v=3","gravatar_id":"","url":"https://api.github.com/users/mudrd8mz","html_url":"https://github.com/mudrd8mz","followers_url":"https://api.github.com/users/mudrd8mz/followers","following_url":"https://api.github.com/users/mudrd8mz/following{/other_user}","gists_url":"https://api.github.com/users/mudrd8mz/gists{/gist_id}","starred_url":"https://api.github.com/users/mudrd8mz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mudrd8mz/subscriptions","organizations_url":"https://api.github.com/users/mudrd8mz/orgs","repos_url":"https://api.github.com/users/mudrd8mz/repos","events_url":"https://api.github.com/users/mudrd8mz/events{/privacy}","received_events_url":"https://api.github.com/users/mudrd8mz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"rachel-smith","id":14046415,"avatar_url":"https://avatars.githubusercontent.com/u/14046415?v=3","gravatar_id":"","url":"https://api.github.com/users/rachel-smith","html_url":"https://github.com/rachel-smith","followers_url":"https://api.github.com/users/rachel-smith/followers","following_url":"https://api.github.com/users/rachel-smith/following{/other_user}","gists_url":"https://api.github.com/users/rachel-smith/gists{/gist_id}","starred_url":"https://api.github.com/users/rachel-smith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rachel-smith/subscriptions","organizations_url":"https://api.github.com/users/rachel-smith/orgs","repos_url":"https://api.github.com/users/rachel-smith/repos","events_url":"https://api.github.com/users/rachel-smith/events{/privacy}","received_events_url":"https://api.github.com/users/rachel-smith/received_events","type":"User","site_admin":false},"milestone":null,"comments":19,"created_at":"2015-11-23T14:06:48Z","updated_at":"2016-05-16T18:03:35Z","closed_at":null,"body":"Scripts like visible.php, favorite.php sort.php and others have very weak access control.\r\n\r\nThe only check you do is `isloggedin()`. Since then, you blindly rely on the passed parameters like `$userid`. As a result, any logged in user can change the setting of the block of any other user.\r\n\r\nThere is no protection against CSRF via sesskey.\r\n\r\nAs I understand it, these scripts are actually server side handlers for AJAX requests. Note the documentation on the recommended way to implement such scripts - e.g. https://docs.moodle.org/dev/AJAX_pre_2.9"},"comment":{"url":"https://api.github.com/repos/UniversityofPortland/moodle-block_custom_course_menu/issues/comments/219498487","html_url":"https://github.com/UniversityofPortland/moodle-block_custom_course_menu/issues/15#issuecomment-219498487","issue_url":"https://api.github.com/repos/UniversityofPortland/moodle-block_custom_course_menu/issues/15","id":219498487,"user":{"login":"upats","id":7084108,"avatar_url":"https://avatars.githubusercontent.com/u/7084108?v=3","gravatar_id":"","url":"https://api.github.com/users/upats","html_url":"https://github.com/upats","followers_url":"https://api.github.com/users/upats/followers","following_url":"https://api.github.com/users/upats/following{/other_user}","gists_url":"https://api.github.com/users/upats/gists{/gist_id}","starred_url":"https://api.github.com/users/upats/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/upats/subscriptions","organizations_url":"https://api.github.com/users/upats/orgs","repos_url":"https://api.github.com/users/upats/repos","events_url":"https://api.github.com/users/upats/events{/privacy}","received_events_url":"https://api.github.com/users/upats/received_events","type":"User","site_admin":false},"created_at":"2016-05-16T18:03:35Z","updated_at":"2016-05-16T18:03:35Z","body":"I believe we used !isloggedin() because the require_login() kept giving us 404 errors when sending post data to the ajax handlers."}}