openwisp-controller 1.3.1__tar.gz → 1.3.2__tar.gz

{openwisp_controller-1.3.1 → openwisp_controller-1.3.2}/CHANGES.rst

@@ -1,6 +1,57 @@
 Changelog
 =========
 
+Version 1.3.3 [2026-10-23]
+--------------------------
+
+Bugfixes
+~~~~~~~~
+
+- Prevented cross-organization configuration access in admin
+
+  Updated admin configuration download and context views to resolve
+  devices, VPNs, and templates through organization-scoped querysets and
+  object permissions.
+
+  This ensures users cannot access configuration data for resources
+  belonging to unauthorized organizations.
+
+  Advisory: `GHSA-2x7f-qxwh-m483
+  <https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-2x7f-qxwh-m483>`_.
+
+- Prevented cross-organization access to configuration downloads
+
+  Updated API configuration download views to resolve devices, VPNs, and
+  templates through organization-scoped querysets and object permissions.
+
+  This ensures users cannot access configuration downloads for resources
+  belonging to unauthorized organizations.
+
+  Advisory: `GHSA-5c5w-h9xc-3mq5
+  <https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-5c5w-h9xc-3mq5>`_.
+
+- Escaped OpenWrt change_password SSH command
+
+  The password and confirm_password values were interpolated into the
+  remote shell command without escaping, allowing shell command injection
+  on the device. They are now quoted with shlex.quote() and passed to
+  printf instead of echo -e, so backslashes are no longer interpreted.
+
+  Advisory: `GHSA-rcf7-q946-fvpg
+  <https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-rcf7-q946-fvpg>`_.
+
+- Prevented cross-organization access to CA CRLs
+
+  Organization managers with permission to view CAs could guess CA IDs and
+  download certificate revocation lists belonging to other organizations.
+
+  The issue did not expose CA private keys or allow changes. It primarily
+  affected deployments configured to protect CRLs, because CRLs are
+  publicly accessible by default.
+
+  Advisory: `GHSA-9gh4-xw24-9xh5
+  <https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-9gh4-xw24-9xh5>`_.
+
 Version 1.3.1 [2026-10-15]
 --------------------------
 
@@ -22,7 +73,8 @@ Security
   and run in a database transaction, preventing rejected requests from
   leaving related database objects or files behind.
 
-  Advisory: **GHSA-39c4-xj33-j8j3**.
+  Advisory: `GHSA-39c4-xj33-j8j3
+  <https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-39c4-xj33-j8j3>`_.
 
 - Fixed XSS vulnerabilities in device and command admin UI
 
@@ -36,7 +88,8 @@ Security
   These vulnerabilities could allow attackers to execute malicious
   JavaScript in an administrator's browser.
 
-  Advisory: **GHSA-4f2x-pxjx-h8m3**.
+  Advisory: `GHSA-4f2x-pxjx-h8m3
+  <https://github.com/openwisp/openwisp-controller/security/advisories/GHSA-4f2x-pxjx-h8m3>`_.
 
 Bugfixes
 ~~~~~~~~

{openwisp_controller-1.3.1/openwisp_controller.egg-info → openwisp_controller-1.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openwisp-controller
-Version: 1.3.1
+Version: 1.3.2
 Summary: OpenWISP Controller
 Home-page: http://openwisp.org
 Download-URL: https://github.com/openwisp/openwisp-controller/releases

{openwisp_controller-1.3.1 → openwisp_controller-1.3.2}/openwisp_controller/__init__.py

@@ -1,4 +1,4 @@
-VERSION = (1, 3, 1, "final")
+VERSION = (1, 3, 2, "final")
 __version__ = VERSION  # alias
 
 

{openwisp_controller-1.3.1 → openwisp_controller-1.3.2}/openwisp_controller/config/admin.py

@@ -13,6 +13,7 @@ from django.contrib.contenttypes.models import ContentType
 from django.core.exceptions import (
     FieldDoesNotExist,
     ObjectDoesNotExist,
+    PermissionDenied,
     ValidationError,
 )
 from django.db import models
@@ -318,7 +319,10 @@ class BaseConfigAdmin(BaseAdmin):
         )
 
     def download_view(self, request, pk):
-        instance = get_object_or_404(self.model, pk=pk)
+        instance = self._get_instance(request, pk)
+        return self.get_download_response(instance)
+
+    def get_download_response(self, instance):
         if hasattr(instance, "generate"):
             config = instance
         elif hasattr(instance, "config"):
@@ -333,10 +337,16 @@ class BaseConfigAdmin(BaseAdmin):
         )
 
     def context_view(self, request, pk):
-        instance = get_object_or_404(self.model, pk=pk)
+        instance = self._get_instance(request, pk)
         context = json.dumps(instance.get_context())
         return HttpResponse(context, content_type="application/json")
 
+    def _get_instance(self, request, pk):
+        instance = get_object_or_404(self.get_queryset(request), pk=pk)
+        if not self.has_view_permission(request, instance):
+            raise PermissionDenied
+        return instance
+
 
 class BaseForm(forms.ModelForm):
     """

{openwisp_controller-1.3.1 → openwisp_controller-1.3.2}/openwisp_controller/config/api/download_views.py

@@ -17,29 +17,29 @@ Template = load_model("config", "Template")
 
 class DownloadVpnView(ProtectedAPIMixin, RetrieveAPIView):
     serializer_class = VpnSerializer
-    queryset = Vpn.objects.none()
+    queryset = Vpn.objects.all()
     model = Vpn
 
     def retrieve(self, request, *args, **kwargs):
-        return BaseConfigAdmin.download_view(self, request, pk=kwargs["pk"])
+        return BaseConfigAdmin.get_download_response(self, self.get_object())
 
 
 class DownloadDeviceView(ProtectedAPIMixin, RetrieveAPIView):
     serializer_class = DeviceListSerializer
-    queryset = Device.objects.none()
+    queryset = Device.objects.all()
     model = Device
 
     def retrieve(self, request, *args, **kwargs):
-        return BaseConfigAdmin.download_view(self, request, pk=kwargs["pk"])
+        return BaseConfigAdmin.get_download_response(self, self.get_object())
 
 
 class DownloadTemplateconfiguration(ProtectedAPIMixin, RetrieveAPIView):
     serializer_class = TemplateSerializer
-    queryset = Template.objects.none()
+    queryset = Template.objects.all()
     model = Template
 
     def retrieve(self, request, *args, **kwargs):
-        return BaseConfigAdmin.download_view(self, request, pk=kwargs["pk"])
+        return BaseConfigAdmin.get_download_response(self, self.get_object())
 
 
 download_vpn_config = DownloadVpnView.as_view()

{openwisp_controller-1.3.1 → openwisp_controller-1.3.2}/openwisp_controller/config/templates/admin/config/device/delete_selected_confirmation.html

@@ -51,7 +51,7 @@
                     {% endblocktranslate %}
                 </p>
                 <span>
-                    <button class="danger-btn" id="warning-ack">"{% blocktranslate count counter=active_devices|length %}I understand the risks, delete the device{% plural %}I understand the risks, delete the devices{% endblocktranslate %}</button>
+                    <button class="danger-btn" id="warning-ack">{% blocktranslate count counter=active_devices|length %}I understand the risks, delete the device{% plural %}I understand the risks, delete the devices{% endblocktranslate %}</button>
                     <button class="button cancel-link">{% translate 'No, take me back' %}</button>
                 </span>
             </li>

{openwisp_controller-1.3.1 → openwisp_controller-1.3.2}/openwisp_controller/config/tests/test_admin.py

@@ -507,6 +507,69 @@ class TestAdmin(
             ],
         )
 
+    def test_config_download_and_context_views_multitenancy(self):
+        data = self._create_multitenancy_test_env(vpn=True)
+        self.client.force_login(data["operator"])
+        instances = {
+            "device": (data["c1"].device, data["c2"].device),
+            "template": (data["t1"], data["t2"]),
+            "vpn": (data["vpn1"], data["vpn2"]),
+        }
+
+        for model, (managed, unmanaged) in instances.items():
+            with self.subTest(model=model, view="download", organization="managed"):
+                response = self.client.get(
+                    reverse(
+                        f"admin:{self.app_label}_{model}_download", args=[managed.pk]
+                    )
+                )
+                self.assertEqual(response.status_code, 200)
+
+            with self.subTest(model=model, view="download", organization="unmanaged"):
+                response = self.client.get(
+                    reverse(
+                        f"admin:{self.app_label}_{model}_download", args=[unmanaged.pk]
+                    )
+                )
+                self.assertEqual(response.status_code, 404)
+
+            with self.subTest(model=model, view="context", organization="managed"):
+                response = self.client.get(
+                    reverse(
+                        f"admin:{self.app_label}_{model}_context", args=[managed.pk]
+                    )
+                )
+                self.assertEqual(response.status_code, 200)
+
+            with self.subTest(model=model, view="context", organization="unmanaged"):
+                response = self.client.get(
+                    reverse(
+                        f"admin:{self.app_label}_{model}_context", args=[unmanaged.pk]
+                    )
+                )
+                self.assertEqual(response.status_code, 404)
+
+            with (
+                self.subTest(model=model, permission="denied"),
+                patch.object(
+                    admin.site._registry[managed.__class__],
+                    "has_view_permission",
+                    return_value=False,
+                ),
+            ):
+                response = self.client.get(
+                    reverse(
+                        f"admin:{self.app_label}_{model}_download", args=[managed.pk]
+                    )
+                )
+                self.assertEqual(response.status_code, 403)
+                response = self.client.get(
+                    reverse(
+                        f"admin:{self.app_label}_{model}_context", args=[managed.pk]
+                    )
+                )
+                self.assertEqual(response.status_code, 403)
+
     def test_vpn_organization_fk_autocomplete_view(self):
         data = self._create_multitenancy_test_env()
         self._test_multitenant_admin(

{openwisp_controller-1.3.1 → openwisp_controller-1.3.2}/openwisp_controller/config/tests/test_api.py

@@ -559,6 +559,68 @@ class TestConfigApi(
             r = self.client.get(path)
         self.assertEqual(r.status_code, 200)
 
+    def test_download_api_multitenancy(self):
+        org1 = self._create_org(name="org1")
+        org2 = self._create_org(name="org2")
+        device1 = self._create_config(organization=org1).device
+        device2 = self._create_config(organization=org2).device
+        template1 = self._create_template(name="template1", organization=org1)
+        template2 = self._create_template(name="template2", organization=org2)
+        vpn1 = self._create_vpn(name="vpn1", organization=org1)
+        vpn2 = self._create_vpn(name="vpn2", organization=org2)
+        shared_vpn = self._create_vpn(name="shared-vpn", organization=None)
+        operator = self._create_operator(organizations=[org1])
+        self.client.force_login(operator)
+
+        with self.subTest("Device of managed organization"):
+            r = self.client.get(
+                reverse("config_api:download_device_config", args=[device1.pk])
+            )
+            self.assertEqual(r.status_code, 200)
+
+        with self.subTest("Device of other organization"):
+            r = self.client.get(
+                reverse("config_api:download_device_config", args=[device2.pk])
+            )
+            self.assertEqual(r.status_code, 404)
+
+        with self.subTest("Template of managed organization"):
+            r = self.client.get(
+                reverse("config_api:download_template_config", args=[template1.pk])
+            )
+            self.assertEqual(r.status_code, 200)
+
+        with self.subTest("Template of other organization"):
+            r = self.client.get(
+                reverse("config_api:download_template_config", args=[template2.pk])
+            )
+            self.assertEqual(r.status_code, 404)
+
+        with self.subTest("VPN of managed organization"):
+            r = self.client.get(
+                reverse("config_api:download_vpn_config", args=[vpn1.pk])
+            )
+            self.assertEqual(r.status_code, 200)
+
+        with self.subTest("VPN of other organization"):
+            r = self.client.get(
+                reverse("config_api:download_vpn_config", args=[vpn2.pk])
+            )
+            self.assertEqual(r.status_code, 404)
+
+        vpn2.get_cached_configuration()
+        with self.subTest("Cached VPN of other organization"):
+            r = self.client.get(
+                reverse("config_api:download_vpn_config", args=[vpn2.pk])
+            )
+            self.assertEqual(r.status_code, 404)
+
+        with self.subTest("Shared VPN"):
+            r = self.client.get(
+                reverse("config_api:download_vpn_config", args=[shared_vpn.pk])
+            )
+            self.assertEqual(r.status_code, 200)
+
     def test_update_deactivated_device(self):
         device = self._create_device(_is_deactivated=True)
         path = reverse("config_api:device_detail", args=[device.pk])

{openwisp_controller-1.3.1 → openwisp_controller-1.3.2}/openwisp_controller/connection/connectors/openwrt/ssh.py

@@ -1,4 +1,5 @@
 import logging
+from shlex import quote
 
 from packaging import version
 
@@ -47,7 +48,8 @@ class OpenWrt(Ssh):
 
     def change_password(self, password, confirm_password, user="root"):
         return self.exec_command(
-            f'echo -e "{password}\n{confirm_password}" | passwd {user}'
+            f"printf '%s\\n%s\\n' {quote(password)} {quote(confirm_password)} "
+            f"| passwd {quote(user)}"
         )
 
 

{openwisp_controller-1.3.1 → openwisp_controller-1.3.2}/openwisp_controller/connection/tests/test_models.py

@@ -782,7 +782,7 @@ HZAAAAgAhZz8ve4sK9Wbopq43Cu2kQDgX4NoA6W+FCmxCKf5AhYIzYQxIqyCazd7MrjCwS""",
             connect_mocked.assert_called_once()
             mocked_exec_command.assert_called_once()
             mocked_exec_command.assert_called_with(
-                'echo -e "Newpasswd@123\nNewpasswd@123" | passwd root',
+                "printf '%s\\n%s\\n' Newpasswd@123 Newpasswd@123 | passwd root",
                 timeout=app_settings.SSH_COMMAND_TIMEOUT,
             )
         command.refresh_from_db()
@@ -790,6 +790,49 @@ HZAAAAgAhZz8ve4sK9Wbopq43Cu2kQDgX4NoA6W+FCmxCKf5AhYIzYQxIqyCazd7MrjCwS""",
         self.assertEqual(command.output, "Changed password for user root.\n")
         self.assertEqual(list(command.arguments), ["********"])
 
+    @mock.patch(_connect_path)
+    def test_execute_change_password_shell_metacharacters(self, connect_mocked):
+        dc = self._create_device_connection()
+
+        def _assert_quoted(password, expected):
+            command = Command(
+                device=dc.device,
+                connection=dc,
+                type="change_password",
+                input={"password": password, "confirm_password": password},
+            )
+            command.full_clean()
+            with mock.patch(_exec_command_path) as mocked_exec_command:
+                mocked_exec_command.return_value = self._exec_command_return_value(
+                    stdout="Changed password for user root."
+                )
+                command.save()
+                command.execute()
+                mocked_exec_command.assert_called_once_with(
+                    f"printf '%s\\n%s\\n' {expected} {expected} | passwd root",
+                    timeout=app_settings.SSH_COMMAND_TIMEOUT,
+                )
+            command.refresh_from_db()
+            self.assertEqual(command.status, "success")
+
+        with self.subTest("safe password left unquoted"):
+            _assert_quoted("N3w-p@ss.word", "N3w-p@ss.word")
+
+        with self.subTest("double quote breakout"):
+            _assert_quoted(
+                'x"; touch /tmp/PWNED; echo "',
+                "'x\"; touch /tmp/PWNED; echo \"'",
+            )
+
+        with self.subTest("command substitution"):
+            _assert_quoted("$(touch /tmp/PWNED)", "'$(touch /tmp/PWNED)'")
+
+        with self.subTest("single quote breakout"):
+            _assert_quoted("x'; touch /tmp/PWNED", "'x'\"'\"'; touch /tmp/PWNED'")
+
+        with self.subTest("backslash kept literal"):
+            _assert_quoted("New\\pass123", "'New\\pass123'")
+
     @mock.patch(_connect_path)
     @mock.patch.dict(
         ORGANIZATION_ENABLED_COMMANDS, {"__all__": ("callable_ping", "path_ping")}

{openwisp_controller-1.3.1 → openwisp_controller-1.3.2}/openwisp_controller/pki/api/views.py

@@ -1,5 +1,4 @@
 from django.http import HttpResponse
-from django.shortcuts import get_object_or_404
 from rest_framework import serializers
 from rest_framework.generics import (
     GenericAPIView,
@@ -53,10 +52,10 @@ class CaRenewView(ProtectedAPIMixin, GenericAPIView):
 
 class CrlDownloadView(ProtectedAPIMixin, RetrieveAPIView):
     serializer_class = CaDetailSerializer
-    queryset = Ca.objects.none()
+    queryset = Ca.objects.all()
 
     def retrieve(self, request, *args, **kwargs):
-        instance = get_object_or_404(Ca, pk=kwargs["pk"])
+        instance = self.get_object()
         return HttpResponse(
             instance.crl, status=200, content_type="application/x-pem-file"
         )

{openwisp_controller-1.3.1 → openwisp_controller-1.3.2}/openwisp_controller/pki/tests/test_api.py

@@ -149,6 +149,27 @@ class TestPkiApi(
             r = self.client.get(path)
         self.assertEqual(r.status_code, 200)
 
+    def test_crl_download_api_multitenancy(self):
+        org1 = self._create_org(name="org1")
+        org2 = self._create_org(name="org2")
+        ca1 = self._create_ca(name="ca1", organization=org1)
+        ca2 = self._create_ca(name="ca2", organization=org2)
+        shared_ca = self._create_ca(name="shared", organization=None)
+        operator = self._create_operator(organizations=[org1])
+        self.client.force_login(operator)
+
+        with self.subTest("CA of managed organization"):
+            r = self.client.get(reverse("pki_api:crl_download", args=[ca1.pk]))
+            self.assertEqual(r.status_code, 200)
+
+        with self.subTest("CA of other organization"):
+            r = self.client.get(reverse("pki_api:crl_download", args=[ca2.pk]))
+            self.assertEqual(r.status_code, 404)
+
+        with self.subTest("shared CA"):
+            r = self.client.get(reverse("pki_api:crl_download", args=[shared_ca.pk]))
+            self.assertEqual(r.status_code, 200)
+
     def test_ca_delete_api(self):
         ca1 = self._create_ca(name="ca1", organization=self._get_org())
         path = reverse("pki_api:ca_detail", args=[ca1.pk])

{openwisp_controller-1.3.1 → openwisp_controller-1.3.2/openwisp_controller.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openwisp-controller
-Version: 1.3.1
+Version: 1.3.2
 Summary: OpenWISP Controller
 Home-page: http://openwisp.org
 Download-URL: https://github.com/openwisp/openwisp-controller/releases