Improper access control of dolos, categories and tags

There is a security issue in the current version of Dolomon. It doesn't properly checked that the right user is accessing contents. So anyone can have access to (almost) all the content hosted by the software.

How to reproduce

• user A creates a dolo, a category, or a tag
• despite the printed error Error The dolo you're trying to show does not belong to you., user B can access this content at the following URLs:
  • DOLOMON_URL/dolo/XXX
  • DOLOMON_URL/cat/XXX
  • DOLOMON_URL/tag/XXX

Note that:

• it is very easy for user B to guess all the URL of dolos, categories and tags, because the ids are incremental. So, in order for user B to save all the content saved by all users, just have to create a new dolo, category and tag, get the last ids, and list all the content from 1 to these ids (or simply start from 1 and stop when there is no content).
• the time serie graph, the referrer list and the CSV export are not impacted by this vulnerability.

How to fix

Dolomon should not print the rest of the page when the error Error The dolo you're trying to show does not belong to you. is trowed.

Examples