[SECURITY ISSUE] bug in multitenancy global search?

[micraux]

Hello,

I am encountering a wrong behavior in the global search, so I post here to see if someone has the same problem, in order to confirm before creating an issue ticket.

I have 2 tenants, each one having its own clients, and I activate the search in the ClientResource.

Everything works fine in the table search: only clients belonging to the current tenant are retrieved.

The global search also works, but there is a problem when I switch tenants: seems that it lacks a "refresh".

Example
I am in Tenant1: every result in global search shows tenant1 in the result url, which works as expected.
Then, I switch to Tenant2: the results url still shows tenant1, and this is the problem.
If I refresh the page 2 or 3 times, the problem disappears.

Could someone try and confirm this?

[micraux]

I tried to investigate a bit more and that might be a problem.

In this example, the client Foo belongs to Tenant 1:

1. In Tenant1, I search for Foo and it shows me the client Foo as expected,
2. I switch to Tenant2 and clear the search input,
3. I type Foo again and it still shows the client Foo with a link heading to tenant1/clients/_foo_id_: SECURITY PROBLEM!
4. I refresh the page, type Foo again and it doesn't show me the client Foo, which is now correct.

I add a middleware as explained here but nothing changes.

Looks like the global search should be flushed when switching tenants...

@danharrin: sorry to bother you as I may have missed something, but could you check this?

[danharrin]

Hi, do you have SPA mode enabled?

[micraux]

Hi Dan,

Yes, I have SPA mode enabled.

I tried to disable it and guess what... it works.

Thanks a lot!

BTW, does this mean we can't use the SPA mode without having this problem, or is there a workaround?

[danharrin]

No, would just explain why things are being persisted across requests. Does mean that its not really a security issue, since it would only happen if you already have access to both tenants. Can you open a bug report with a simple reproduction repo please?

[Plytas]

@danharrin somehow I missed this discussion when registering an issue #14196. It includes a reproduction repo and videos explaining the issue.

[renatofrota]

for the moment, try adding spaUrlExceptions() to your $panel, e.g.:

->spaUrlExceptions(['*/lang/*', '...'])

and include the path you use to switch tenants. it will make that route behave as a common link (full page load).

[danharrin]

Fixed by #14744

[micraux]

Thanks!