Uploaded image for project: 'Project Simple'
  1. Project Simple
  2. ST-250

Insecure direct Object Reference: Confirmation statement

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Medium
    • Resolution: Done
    • Component/s: BenAdmin
    • Labels:
      None
    • Module:
      BenAdmin - Security
    • Reported by:
      Support
    • Item State:
      Production Complete - Closed
    • Issue Importance:
      Must Have

      Description

      URL:
      https://wt-stage.harbinger.in/Assets/Temp/d4b28f08-dfb5-4923-850c-c53bac2383f6.pdf

      Description:
      login with employee credentials and in confirmation statement there is
      Option to export pdf. This link can be directly accessed and viewed from different machines without Credentials.

      Resolution:
      Restrict all post login pages from getting accessed directly.
      Authorization of the user specific resource must be implemented and publicly they should not be accessible

        Attachments

          Activity

          Hide
          vijayendra Vijayendra Shinde (Inactive) added a comment - - edited

          Affected files:

          /trunk/WORKTERRAweb/Web/Web Projects/BenAdmin/Areas/ACA/Views/ACA/ACAAnalytics/PCORIReport.cshtml
          /trunk/WORKTERRAweb/Web/Web Projects/BenAdmin/Areas/UserDetails/Views/UserDetails/EnrollmentSummary/EnrollmentSummary.cshtml

          Newly added:
          SharedFunctionWebTier/SharedFunctionWebTier/Views/Shared/NotFound.cshtml
          SharedFunctionWebTier/SharedFunctionWebTier/Views/Shared/NotFound.generated.cs
          Web Projects/WORKTERRA/ReportViewer/ViewReport.aspx.cs

          Show
          vijayendra Vijayendra Shinde (Inactive) added a comment - - edited Affected files: /trunk/WORKTERRAweb/Web/Web Projects/BenAdmin/Areas/ACA/Views/ACA/ACAAnalytics/PCORIReport.cshtml /trunk/WORKTERRAweb/Web/Web Projects/BenAdmin/Areas/UserDetails/Views/UserDetails/EnrollmentSummary/EnrollmentSummary.cshtml Newly added: SharedFunctionWebTier/SharedFunctionWebTier/Views/Shared/NotFound.cshtml SharedFunctionWebTier/SharedFunctionWebTier/Views/Shared/NotFound.generated.cs Web Projects/WORKTERRA/ReportViewer/ViewReport.aspx.cs
          Hide
          deepalit Deepali Tidke (Inactive) added a comment -

          Checked the Confirmation statement from EE, partner and admin level >> now on click of PDF for confirmation statement >> statement get downloads.

          Sachin Hingole kindly put the comments for PCORI

          Show
          deepalit Deepali Tidke (Inactive) added a comment - Checked the Confirmation statement from EE, partner and admin level >> now on click of PDF for confirmation statement >> statement get downloads. Sachin Hingole kindly put the comments for PCORI
          Hide
          sachin.hingole Sachin Hingole (Inactive) added a comment -

          PCORI is downloaded without issue for Partner Login.
          It does nothing when tried using admin login.

          Steps
          1] Log in to WT-Stage using ADMIN login
          2] Go to ACA -> ACA Analytics -> PCORI ->
          3] Provide date range and click on Preview button
          4] Click on PDF button from top of page

          actual result - does nothing, refer error log 07_18_2016_15_39_20_921_3864_2.txt
          expected result - It should download pdf

          Show
          sachin.hingole Sachin Hingole (Inactive) added a comment - PCORI is downloaded without issue for Partner Login. It does nothing when tried using admin login. Steps 1] Log in to WT-Stage using ADMIN login 2] Go to ACA -> ACA Analytics -> PCORI -> 3] Provide date range and click on Preview button 4] Click on PDF button from top of page actual result - does nothing, refer error log 07_18_2016_15_39_20_921_3864_2.txt expected result - It should download pdf
          Hide
          vijayendra Vijayendra Shinde (Inactive) added a comment -

          Hi Deepali,

          We have authorized report viewer urls as well. When we run reports, reports run in new windows with URL exposed. If user copied that URL and pasted it in new browser, we have redirected user on Login page. So unauthorized user will not be able to view reports.

          Please verify this once.

          Show
          vijayendra Vijayendra Shinde (Inactive) added a comment - Hi Deepali, We have authorized report viewer urls as well. When we run reports, reports run in new windows with URL exposed. If user copied that URL and pasted it in new browser, we have redirected user on Login page. So unauthorized user will not be able to view reports. Please verify this once.
          Hide
          kumar.chhajed Kumar Chhajed (Inactive) added a comment -

          Vijayendra Shinde

          Files affected -

          /Database Objects/OnlineEnrollment/07_Data/25_WT250_WTB_ACA_ModData_PageLevelAccess.sql

          Show
          kumar.chhajed Kumar Chhajed (Inactive) added a comment - Vijayendra Shinde Files affected - /Database Objects/OnlineEnrollment/07_Data/25_WT250_WTB_ACA_ModData_PageLevelAccess.sql
          Hide
          sachin.hingole Sachin Hingole (Inactive) added a comment -

          Verified the fix for above comment related to Company Admin User login.
          Company Admin able to download PDF without error.

          Show
          sachin.hingole Sachin Hingole (Inactive) added a comment - Verified the fix for above comment related to Company Admin User login. Company Admin able to download PDF without error.
          Hide
          deepalit Deepali Tidke (Inactive) added a comment -

          Vijayendra Shinde I have verified report URL's on LB , now if user copied report URL that opened in new window and pasted it in new browser, it gets redirected on Login page

          Show
          deepalit Deepali Tidke (Inactive) added a comment - Vijayendra Shinde I have verified report URL's on LB , now if user copied report URL that opened in new window and pasted it in new browser, it gets redirected on Login page
          Hide
          sachin.hingole Sachin Hingole (Inactive) added a comment -

          PCORI is downloaded without issue for Partner Login and Admin Login.

          Deepali Tidke Please verify confirmation statement report using all log in.

          Show
          sachin.hingole Sachin Hingole (Inactive) added a comment - PCORI is downloaded without issue for Partner Login and Admin Login. Deepali Tidke Please verify confirmation statement report using all log in.
          Hide
          deepalit Deepali Tidke (Inactive) added a comment - - edited

          Checked the Confirmation statement from EE, partner and admin level >> now on click of PDF for confirmation statement >> statement downloads.

          Show
          deepalit Deepali Tidke (Inactive) added a comment - - edited Checked the Confirmation statement from EE, partner and admin level >> now on click of PDF for confirmation statement >> statement downloads.
          Hide
          kumar.chhajed Kumar Chhajed (Inactive) added a comment -

          Vijayendra Shinde Deepali Tidke Sachin Hingole

          Note - The point deployed under this JIRA on Production is only for the issue of PCORI download for Admin login. Other points will get deployed after production build.

          Show
          kumar.chhajed Kumar Chhajed (Inactive) added a comment - Vijayendra Shinde Deepali Tidke Sachin Hingole Note - The point deployed under this JIRA on Production is only for the issue of PCORI download for Admin login. Other points will get deployed after production build.
          Hide
          sachin.hingole Sachin Hingole (Inactive) added a comment -

          PCORI is downloaded without issue for Partner Login and Admin Login.

          Deepali Tidke Please verify confirmation statement report using all log in and close this JIRA.

          Show
          sachin.hingole Sachin Hingole (Inactive) added a comment - PCORI is downloaded without issue for Partner Login and Admin Login. Deepali Tidke Please verify confirmation statement report using all log in and close this JIRA.
          Hide
          rakeshr Rakesh Roy (Inactive) added a comment -

          Working fine for confirmation statement.

          Show
          rakeshr Rakesh Roy (Inactive) added a comment - Working fine for confirmation statement.

            People

            Assignee:
            sachin.hingole Sachin Hingole (Inactive)
            Reporter:
            vijayendra Vijayendra Shinde (Inactive)
            Developer:
            Kumar Chhajed (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:
              Pre-Prod Due Date:
              Production Due Date: