GHSA-vxq2-p937-3px3
Pinned entity creation form shows wrong data
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | oro/platform | >= 5.1.0, < 5.1.4 | 5.1.4 |
| Packagist | oro/platform | >= 5.0.0, <= 5.0.12 | no fix listed |
| Packagist | oro/platform | >= 4.2.0, <= 4.2.10 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Logged in user can access page state data of pinned pages of other users by pageId hash.
### Patch
```patch
--- src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php
+++ src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php
@@ -158,6 +158,13 @@
AbstractPageState::generateHash($this->get('request_stack')->getCurrentRequest()->get('pageId'))
);
+ if ($entity) {
+ $entity = $this->getEntity($entity->getId());
+ }
+ if (!$entity) {
+ return $this->handleNotFound();
+ }
+
return $this->handleView($this->view($this->getState($entity), Response::HTTP_OK));
}
```
References
External links from the advisory. They lead to third-party sites.