mirror of
https://github.com/wekan/wekan.git
synced 2026-11-07 11:02:33 -05:00
Lauri Ojansivu
5c1f6088f4
GHSA-qcfm-2g4w-wqcc. Admin Panel / Settings / Visibility / "Only admins can create boards" (#4475) was checked only inside createBoardWithInitialSwimlanes, the Add Board form. A non-admin still created working boards by a client Boards.insert (Boards.allow.insert approves any signed-in user), POST /api/boards and both board import routes, as reported, and also by importBoard, cloneBoard, copyBoard, POST /api/boards/:boardId/copy and createBoardFromCard. One decision (models/lib/boardCreationPolicy.js) and one guard (server/lib/boardCreationGuard.js) are asked by every one of those paths before they write, and by a new Boards.deny insert rule. A board template stays every member's own; boards WeKan makes itself (a Templates container, a board's subtasks board) are not created by the user. A REST refusal is 403. A refusal is recorded in Admin Panel / Problems as CreateBleed (authz.board-creation, low, CWE-863, blocks no account), and Duplicate and "Create board from card" are hidden like Add Board, so only a client bypassing the interface reaches it. tests/createBleed.test.cjs drives the decision, the guard and the real deny rule against the reporter's console insert, and fails if any path that creates a board for a user does not ask the guard, or if anything else reads the setting. tests/playwright/specs/createbleed-board-creation-admin-only.e2e.js replays the report against a running server. The guards that pinned the old inline check now pin the shared one. Thanks to tsurutanmen and xet7 !