[ST-250] Insecure direct Object Reference: Confirmation statement - Workterra Jira

Details

Type: Bug
Status: Closed
Priority: Medium
Resolution: Done
Component/s: BenAdmin
Labels:
None

Module:
BenAdmin - Security
Reported by:
Support
Item State:
Production Complete - Closed
Issue Importance:
Must Have

Description

URL:
https://wt-stage.harbinger.in/Assets/Temp/d4b28f08-dfb5-4923-850c-c53bac2383f6.pdf

Description:
login with employee credentials and in confirmation statement there is
Option to export pdf. This link can be directly accessed and viewed from different machines without Credentials.

Resolution:
Restrict all post login pages from getting accessed directly.
Authorization of the user specific resource must be implemented and publicly they should not be accessible

Vijayendra Shinde (Inactive) created issue - 13/Jul/16 07:22 AM

Vijayendra Shinde (Inactive) made changes - 13/Jul/16 07:22 AM

Field	Original Value	New Value
Assignee		Vijayendra Shinde [ ID10506 ]

Vijayendra Shinde (Inactive) made changes - 13/Jul/16 07:22 AM

Status

Open [ 1 ]

In Development [ 10007 ]

Hide

Permalink

Vijayendra Shinde (Inactive) added a comment - 13/Jul/16 08:40 AM - edited

Affected files:

/trunk/WORKTERRAweb/Web/Web Projects/BenAdmin/Areas/ACA/Views/ACA/ACAAnalytics/PCORIReport.cshtml
/trunk/WORKTERRAweb/Web/Web Projects/BenAdmin/Areas/UserDetails/Views/UserDetails/EnrollmentSummary/EnrollmentSummary.cshtml

Newly added:
SharedFunctionWebTier/SharedFunctionWebTier/Views/Shared/NotFound.cshtml
SharedFunctionWebTier/SharedFunctionWebTier/Views/Shared/NotFound.generated.cs
Web Projects/WORKTERRA/ReportViewer/ViewReport.aspx.cs

Show

Vijayendra Shinde (Inactive) added a comment - 13/Jul/16 08:40 AM - edited Affected files: /trunk/WORKTERRAweb/Web/Web Projects/BenAdmin/Areas/ACA/Views/ACA/ACAAnalytics/PCORIReport.cshtml /trunk/WORKTERRAweb/Web/Web Projects/BenAdmin/Areas/UserDetails/Views/UserDetails/EnrollmentSummary/EnrollmentSummary.cshtml Newly added: SharedFunctionWebTier/SharedFunctionWebTier/Views/Shared/NotFound.cshtml SharedFunctionWebTier/SharedFunctionWebTier/Views/Shared/NotFound.generated.cs Web Projects/WORKTERRA/ReportViewer/ViewReport.aspx.cs

Vijayendra Shinde (Inactive) made changes - 15/Jul/16 09:57 AM

Item State

Parent values: Development(10200)Level 1 values: In Progress(10206)

Parent values: Development(10200)Level 1 values: Ready for Local Testing(10209)

Gokul Sonawane (Inactive) made changes - 15/Jul/16 11:33 AM

Item State

Parent values: Development(10200)Level 1 values: Ready for Local Testing(10209)

Parent values: LB QA(10201)

Vijayendra Shinde (Inactive) made changes - 18/Jul/16 08:25 AM

Assignee

Vijayendra Shinde [ ID10506 ]

Deepali Tidke [ deepalit ]

Vijayendra Shinde (Inactive) made changes - 18/Jul/16 08:27 AM

Item State

Parent values: LB QA(10201)

Parent values: LB QA(10201)Level 1 values: LB Deployed(11600)

Deepali Tidke (Inactive) made changes - 18/Jul/16 09:02 AM

Status

In Development [ 10007 ]

Local Testing [ 10200 ]

Hide

Permalink

Deepali Tidke (Inactive) added a comment - 18/Jul/16 10:05 AM

Checked the Confirmation statement from EE, partner and admin level >> now on click of PDF for confirmation statement >> statement get downloads.

Sachin Hingole kindly put the comments for PCORI

Show

Deepali Tidke (Inactive) added a comment - 18/Jul/16 10:05 AM Checked the Confirmation statement from EE, partner and admin level >> now on click of PDF for confirmation statement >> statement get downloads. Sachin Hingole kindly put the comments for PCORI

Sachin Hingole (Inactive) made changes - 18/Jul/16 10:05 AM

Status

Local Testing [ 10200 ]

Reopen in Local [ 10018 ]

Sachin Hingole (Inactive) made changes - 18/Jul/16 10:06 AM

Item State

Parent values: LB QA(10201)Level 1 values: LB Deployed(11600)

Parent values: Development(10200)

Sachin Hingole (Inactive) made changes - 18/Jul/16 10:10 AM

Attachment

07_18_2016_15_39_20_921_3864_2.txt [ 22103 ]

Hide

Permalink

Sachin Hingole (Inactive) added a comment - 18/Jul/16 10:11 AM

PCORI is downloaded without issue for Partner Login.
It does nothing when tried using admin login.

Steps
1] Log in to WT-Stage using ADMIN login
2] Go to ACA -> ACA Analytics -> PCORI ->
3] Provide date range and click on Preview button
4] Click on PDF button from top of page

actual result - does nothing, refer error log 07_18_2016_15_39_20_921_3864_2.txt
expected result - It should download pdf

Show

Sachin Hingole (Inactive) added a comment - 18/Jul/16 10:11 AM PCORI is downloaded without issue for Partner Login. It does nothing when tried using admin login. Steps 1] Log in to WT-Stage using ADMIN login 2] Go to ACA -> ACA Analytics -> PCORI -> 3] Provide date range and click on Preview button 4] Click on PDF button from top of page actual result - does nothing, refer error log 07_18_2016_15_39_20_921_3864_2.txt expected result - It should download pdf

Sachin Hingole (Inactive) made changes - 18/Jul/16 10:11 AM

Assignee

Deepali Tidke [ deepalit ]

Vijayendra Shinde [ ID10506 ]

Kumar Chhajed (Inactive) made changes - 18/Jul/16 11:36 AM

Status

Reopen in Local [ 10018 ]

In Development [ 10007 ]

Kumar Chhajed (Inactive) made changes - 18/Jul/16 11:36 AM

Item State

Parent values: Development(10200)

Parent values: Development(10200)Level 1 values: Ready for Local Testing(10209)

Kumar Chhajed (Inactive) made changes - 18/Jul/16 11:36 AM

Assignee

Vijayendra Shinde [ ID10506 ]

Kumar Chhajed [ kumar.chhajed ]

Hide

Permalink

Vijayendra Shinde (Inactive) added a comment - 19/Jul/16 05:39 AM

Hi Deepali,

We have authorized report viewer urls as well. When we run reports, reports run in new windows with URL exposed. If user copied that URL and pasted it in new browser, we have redirected user on Login page. So unauthorized user will not be able to view reports.

Please verify this once.

Show

Vijayendra Shinde (Inactive) added a comment - 19/Jul/16 05:39 AM Hi Deepali, We have authorized report viewer urls as well. When we run reports, reports run in new windows with URL exposed. If user copied that URL and pasted it in new browser, we have redirected user on Login page. So unauthorized user will not be able to view reports. Please verify this once.

Gokul Sonawane (Inactive) made changes - 19/Jul/16 11:42 AM

Item State

Parent values: Development(10200)Level 1 values: Ready for Local Testing(10209)

Parent values: LB QA(10201)Level 1 values: LB Deployed(11600)

Kumar Chhajed (Inactive) made changes - 19/Jul/16 11:47 AM

Assignee

Kumar Chhajed [ kumar.chhajed ]

Sachin Hingole [ sachin.hingole ]

Kumar Chhajed (Inactive) made changes - 19/Jul/16 11:47 AM

Status

In Development [ 10007 ]

Local Testing [ 10200 ]

Hide

Permalink

Kumar Chhajed (Inactive) added a comment - 19/Jul/16 11:49 AM

Vijayendra Shinde

Files affected -

/Database Objects/OnlineEnrollment/07_Data/25_WT250_WTB_ACA_ModData_PageLevelAccess.sql

Show

Kumar Chhajed (Inactive) added a comment - 19/Jul/16 11:49 AM Vijayendra Shinde Files affected - /Database Objects/OnlineEnrollment/07_Data/25_WT250_WTB_ACA_ModData_PageLevelAccess.sql

Sachin Hingole (Inactive) made changes - 19/Jul/16 12:10 PM

Item State

Parent values: LB QA(10201)Level 1 values: LB Deployed(11600)

Parent values: LB QA(10201)Level 1 values: In Testing(10210)

Sachin Hingole (Inactive) made changes - 19/Jul/16 12:10 PM

Status

Local Testing [ 10200 ]

Reopen in Local [ 10018 ]

Sachin Hingole (Inactive) made changes - 19/Jul/16 12:10 PM

Status

Reopen in Local [ 10018 ]

In Development [ 10007 ]

Sachin Hingole (Inactive) made changes - 19/Jul/16 12:10 PM

Status

In Development [ 10007 ]

Local Testing [ 10200 ]

Sachin Hingole (Inactive) made changes - 19/Jul/16 12:10 PM

Item State

Parent values: LB QA(10201)Level 1 values: In Testing(10210)

Parent values: LB QA(10201)Level 1 values: Ready for Stage(10213)

Hide

Permalink

Sachin Hingole (Inactive) added a comment - 19/Jul/16 12:12 PM

Verified the fix for above comment related to Company Admin User login.
Company Admin able to download PDF without error.

Show

Sachin Hingole (Inactive) added a comment - 19/Jul/16 12:12 PM Verified the fix for above comment related to Company Admin User login. Company Admin able to download PDF without error.

Sachin Hingole (Inactive) made changes - 19/Jul/16 12:13 PM

Stage Due Date

25/Jul/16 [ 2016-07-25 ]

Hide

Permalink

Deepali Tidke (Inactive) added a comment - 19/Jul/16 12:14 PM

Vijayendra Shinde I have verified report URL's on LB , now if user copied report URL that opened in new window and pasted it in new browser, it gets redirected on Login page

Show

Deepali Tidke (Inactive) added a comment - 19/Jul/16 12:14 PM Vijayendra Shinde I have verified report URL's on LB , now if user copied report URL that opened in new window and pasted it in new browser, it gets redirected on Login page

Deepali Tidke (Inactive) made changes - 19/Jul/16 12:14 PM

Production Due Date

26/Jul/2016

Hide

Permalink

Sachin Hingole (Inactive) added a comment - 24/Jul/16 07:40 AM

PCORI is downloaded without issue for Partner Login and Admin Login.

Deepali Tidke Please verify confirmation statement report using all log in.

Show

Sachin Hingole (Inactive) added a comment - 24/Jul/16 07:40 AM PCORI is downloaded without issue for Partner Login and Admin Login. Deepali Tidke Please verify confirmation statement report using all log in.

Hide

Permalink

Deepali Tidke (Inactive) added a comment - 25/Jul/16 09:05 AM - edited

Checked the Confirmation statement from EE, partner and admin level >> now on click of PDF for confirmation statement >> statement downloads.

Show

Deepali Tidke (Inactive) added a comment - 25/Jul/16 09:05 AM - edited Checked the Confirmation statement from EE, partner and admin level >> now on click of PDF for confirmation statement >> statement downloads.

Deepali Tidke (Inactive) made changes - 25/Jul/16 09:05 AM

Item State

Parent values: LB QA(10201)Level 1 values: Ready for Stage(10213)

Parent values: Stage QA(10202)Level 1 values: Ready for Production(10217)

Deepali Tidke (Inactive) made changes - 25/Jul/16 09:05 AM

Status

Local Testing [ 10200 ]

Stage Testing [ 10201 ]

Deepali Tidke (Inactive) made changes - 25/Jul/16 09:05 AM

Status

Stage Testing [ 10201 ]

Production Testing [ 10202 ]

Rakesh Roy (Inactive) made changes - 27/Jul/16 09:18 AM

Developer

Kumar Chhajed [ kumar.chhajed ]

Ashwin Wankhede (Inactive) made changes - 28/Jul/16 05:00 AM

Item State

Parent values: Stage QA(10202)Level 1 values: Ready for Production(10217)

Parent values: Production QA(10203)Level 1 values: Production Deployed(10221)

Hide

Permalink

Kumar Chhajed (Inactive) added a comment - 28/Jul/16 06:20 AM

Vijayendra Shinde Deepali Tidke Sachin Hingole

Note - The point deployed under this JIRA on Production is only for the issue of PCORI download for Admin login. Other points will get deployed after production build.

Show

Kumar Chhajed (Inactive) added a comment - 28/Jul/16 06:20 AM Vijayendra Shinde Deepali Tidke Sachin Hingole Note - The point deployed under this JIRA on Production is only for the issue of PCORI download for Admin login. Other points will get deployed after production build.

Kumar Chhajed (Inactive) made changes - 28/Jul/16 06:27 AM

Item State

Parent values: Production QA(10203)Level 1 values: Production Deployed(10221)

Parent values: Stage QA(10202)Level 1 values: Ready for Production(10217)

Hide

Permalink

Sachin Hingole (Inactive) added a comment - 28/Jul/16 07:43 AM

PCORI is downloaded without issue for Partner Login and Admin Login.

Deepali Tidke Please verify confirmation statement report using all log in and close this JIRA.

Show

Sachin Hingole (Inactive) added a comment - 28/Jul/16 07:43 AM PCORI is downloaded without issue for Partner Login and Admin Login. Deepali Tidke Please verify confirmation statement report using all log in and close this JIRA.

Sachin Hingole (Inactive) made changes - 28/Jul/16 07:43 AM

Item State

Parent values: Stage QA(10202)Level 1 values: Ready for Production(10217)

Parent values: Production QA(10203)Level 1 values: In Testing(10218)

Hide

Permalink

Rakesh Roy (Inactive) added a comment - 01/Aug/16 06:26 PM

Working fine for confirmation statement.

Show

Rakesh Roy (Inactive) added a comment - 01/Aug/16 06:26 PM Working fine for confirmation statement.

Rakesh Roy (Inactive) made changes - 01/Aug/16 06:26 PM

Resolution		Fixed [ 1 ]
Status	Production Testing [ 10202 ]	Production Complete [ 10028 ]

Rakesh Roy (Inactive) made changes - 01/Aug/16 06:26 PM

Item State

Parent values: Production QA(10203)Level 1 values: In Testing(10218)

Parent values: Production Complete(10222)Level 1 values: Closed(10223)

Rakesh Roy (Inactive) made changes - 01/Aug/16 06:26 PM

Status

Production Complete [ 10028 ]

Closed [ 6 ]

Transition	Time In Source Status	Execution Times

Vijayendra Shinde (Inactive) made transition - 13/Jul/16 07:22 AM

Open

In Development

17s

Sachin Hingole (Inactive) made transition - 19/Jul/16 12:10 PM

In LB Testing

Reopen in Local

1h 25m

Sachin Hingole (Inactive) made transition - 19/Jul/16 12:10 PM

Reopen in Local

In Development

1h 30m

Sachin Hingole (Inactive) made transition - 19/Jul/16 12:10 PM

In Development

In LB Testing

6d 1h 51m

Deepali Tidke (Inactive) made transition - 25/Jul/16 09:05 AM

In LB Testing

Stage Testing

5d 20h 54m

Deepali Tidke (Inactive) made transition - 25/Jul/16 09:05 AM

Stage Testing

In Production Testing

Rakesh Roy (Inactive) made transition - 01/Aug/16 06:26 PM

In Production Testing

Production Complete

7d 9h 20m

Rakesh Roy (Inactive) made transition - 01/Aug/16 06:26 PM

Production Complete

Closed

14s

People

Assignee:: Sachin Hingole (Inactive)

Reporter:: Vijayendra Shinde (Inactive)

Developer:: Kumar Chhajed (Inactive)

Votes:: 0 Vote for this issue

Watchers:: 5 Start watching this issue

Dates

Created:: 13/Jul/16 07:22 AM

Updated:: 01/Aug/16 06:26 PM

Resolved:: 01/Aug/16 06:26 PM

Pre-Prod Due Date:: 25/Jul/2016

Production Due Date:: 26/Jul/2016

Details

Description

Attachments

Attachments

Activity

People

Dates