An endpoint in the publication module was incorrectly trusting the baseURL submitted by a user's POST request rather than the internal LORIS value.
This could result in a theoretical attacker with publication module access forging an email to an external domain under the attacker's control which appeared to come from LORIS.
diff --git a/modules/publication/ajax/FileUpload.php b/modules/publication/ajax/FileUpload.php
index 0a7448e145..c5f4426244 100644
--- a/modules/publication/ajax/FileUpload.php
+++ b/modules/publication/ajax/FileUpload.php
@@ -140,7 +140,7 @@ function uploadPublication() : void
showPublicationError($e->getMessage(), 500);
}
- notify($pubID, 'submission', $_POST['baseURL']);
+ notify($pubID, 'submission');
}
/**
@@ -428,13 +428,12 @@ function cleanup(int $pubID) : void
/**
* Send out email notifications for project submission
*
- * @param int $pubID publication ID
- * @param string $type The notification type i.e., submission|edit|review
- * @param string $baseURL the base URL of the loris site
+ * @param int $pubID publication ID
+ * @param string $type The notification type i.e., submission|edit|review
*
* @return void
*/
-function notify($pubID, $type, $baseURL) : void
+function notify($pubID, $type) : void
{
$acceptedTypes = [
'submission',
@@ -471,14 +470,12 @@ function notify($pubID, $type, $baseURL) : void
$emailData['Title'] = $data['Title'];
$emailData['Date'] = $data['DateProposed'];
$emailData['User'] = $user->getFullname();
- $emailData['URL'] = $baseURL . '/publication/view_project/?id='.$pubID;
$emailData['ProjectName'] = $config->getSetting('prefix');
$Notifier = new \NDB_Notifier(
"publication",
$type
);
$msg_data = [
- 'URL' => $emailData['URL'],
'Title' => $emailData['Title'],
'User' => $emailData['User'],
'ProjectName' => $emailData['ProjectName'],
@@ -650,10 +647,10 @@ function editProject() : void
processFiles($id);
// if publication status is changed, send review email
if (isset($toUpdate['PublicationStatusID'])) {
- notify($id, 'review', $_POST['baseURL']);
+ notify($id, 'review');
} else {
// otherwise send edit email
- notify($id, 'edit', $_POST['baseURL']);
+ notify($id, 'edit');
}
if (!empty($toUpdate)) {
$db->update(
diff --git a/smarty/templates/email/notifier_publication_edit.tpl b/smarty/templates/email/notifier_publication_edit.tpl
index f8caa2db72..d27059b45c 100644
--- a/smarty/templates/email/notifier_publication_edit.tpl
+++ b/smarty/templates/email/notifier_publication_edit.tpl
@@ -3,7 +3,7 @@ Subject: [LORIS] A project proposal has been edited
Hello,
The project proposal "{$Title}" has been edited by {$User}.
-You can view the changes by clicking the following link {$URL}.
+You can view the changes in the loris website.
Thank you,
The {$ProjectName} Team
diff --git a/smarty/templates/email/notifier_publication_review.tpl b/smarty/templates/email/notifier_publication_review.tpl
index fa80bf6c69..c2677b54b9 100644
--- a/smarty/templates/email/notifier_publication_review.tpl
+++ b/smarty/templates/email/notifier_publication_review.tpl
@@ -3,7 +3,7 @@ Subject: [LORIS] A project proposal has been reviewed
Hello,
The project proposal "{$Title}" has been reviewed.
-You can view the details by clicking the following link {$URL}.
+You can view the details in the loris website.
Thank you,
The {$ProjectName} Team
diff --git a/smarty/templates/email/notifier_publication_submission.tpl b/smarty/templates/email/notifier_publication_submission.tpl
index c5a304fbcd..976d5abb8e 100644
--- a/smarty/templates/email/notifier_publication_submission.tpl
+++ b/smarty/templates/email/notifier_publication_submission.tpl
@@ -4,7 +4,7 @@ Hello,
This is to confirm the project proposal "{$Title}" received on {$Date}.
We will notify you once this proposal has been reviewed. In the mean time, you
-can view the project proposal through the following link: {$URL}.
+can view the project proposal in the loris website.
Thank you,
The {$ProjectName} Team
A project not using the publication module can disable the publication module in LORIS.
Impact
An endpoint in the publication module was incorrectly trusting the baseURL submitted by a user's POST request rather than the internal LORIS value.
This could result in a theoretical attacker with publication module access forging an email to an external domain under the attacker's control which appeared to come from LORIS.
Patches
Workarounds
A project not using the publication module can disable the publication module in LORIS.