Redmine

Nikola Stojiljkovic Milanov: Thanks for reporting this issue.

I was able to reproduce the reported behavior using the provided steps on an old 4.2-stable (Rails 5.x) playground. I think this affects current trunk (Rails 6.x) too, but I haven't actually tested this.

I currently don't know for sure how pervasive this behavior is in that it might extend to other fields and/or modules, but this should nevertheless be properly investigated and acted upon given the potential security implications of this issue (issue and (custom) field visibility, workflows, assignees, API-request behavior, etc.).

• set the issue to private;
• set the issue priority to High;
• set the issue category to Security; and
• add Go, Holger and Marius as watchers.

@Go, holger mareck, Marius Ionescu: Can you'll have a look into this matter?

I'll have a look later today.

Attached, there are two patches to improve the validations:

• 0001-Validate-category_id-against-available-categories-in.patch added the validation for the category_id to ensure that the given category is valid within the issue's project.
• 0002-Validate-fixed_version_id-to-ensure-that-a-version-w.patch improves the validation of the fixed_version_id to ensure that no invalid version (that is: one that does not exist at all) can be given.

I think all of the other fields are fine since they either reference global data (project, tracker, assigned_to, author, status) and/or are correctly checked already.

Marius or Maeda-san, could either of you check those patches and merge them? They should cleanly apply to the current trunk, 5.0-stable and 4.2-stable. I'm assigning the issue to Marius, please feel free to re-assign as necessary.

Thanks, I've committed both patches and I'm going to merge them to the stable branches once the tests pass.

Merged to stable branches.