[buddypress-trac] [BuddyPress] #2343: SECURITY RISK (internal): Forum posts are "promiscuous" and can masquerade as belonging to other forums

[buddypress-trac at lists.automattic.com]

#2343: SECURITY RISK (internal): Forum posts are "promiscuous" and can masquerade
as belonging to other forums
----------------------+-----------------------------------------------------
 Reporter:  3sixty    |       Owner:       
     Type:  defect    |      Status:  new  
 Priority:  critical  |   Milestone:  1.2.4
Component:  Forums    |    Keywords:       
----------------------+-----------------------------------------------------
 Forum posts are "promiscuous" and can masquerade as belonging to other
 forums - even if it is a private forum (probably also a problem with
 hidden forums).

 Here is a working example from testbp.org. Start with this private topic
 that you do not have rights to view:

 http://testbp.org/groups/secret-private-group-you-should-never-ever-
 see/forum/topic/super-secret-post/

 Now, replace group name with any existing other group name, such as
 /baseball/ , and you will now see the private topic:

 http://testbp.org/groups/baseball/forum/topic/super-secret-post/

 This example shows how an unauthorized user can have access to private
 posts they should not be seeing.

-- 
Ticket URL: <http://trac.buddypress.org/ticket/2343>
BuddyPress <http://buddypress.org/>
BuddyPress