Batch and ImportExport controllers lack ACL permission checks #37

New Issue

2026-05-31T01:18:58Z

jmiller commented

2026-05-31 01:18:58 +00:00

Problem

BatchController and ImportExportController only verify CSRF tokens (Session::checkToken()) but do not check Joomla ACL permissions.

Any authenticated backend user (even with minimal permissions) could:

Trigger batch OG generation for all articles
Export all OG data as CSV
Import/overwrite OG data via CSV upload

Impact

Privilege escalation - users without core.manage or core.edit on com_mokoog can modify data.

Acceptance Criteria

All controller actions check $this->app->getIdentity()->authorise('core.manage', 'com_mokoog')
Import requires core.create + core.edit permissions
Export requires core.manage permission
Batch requires core.create permission
Return 403 with appropriate error message on denial

Files

src/packages/com_mokoog/src/Controller/BatchController.php
src/packages/com_mokoog/src/Controller/ImportExportController.php

## Problem `BatchController` and `ImportExportController` only verify CSRF tokens (`Session::checkToken()`) but do not check Joomla ACL permissions. Any authenticated backend user (even with minimal permissions) could: - Trigger batch OG generation for all articles - Export all OG data as CSV - Import/overwrite OG data via CSV upload ## Impact Privilege escalation - users without `core.manage` or `core.edit` on `com_mokoog` can modify data. ## Acceptance Criteria - [ ] All controller actions check `$this->app->getIdentity()->authorise('core.manage', 'com_mokoog')` - [ ] Import requires `core.create` + `core.edit` permissions - [ ] Export requires `core.manage` permission - [ ] Batch requires `core.create` permission - [ ] Return 403 with appropriate error message on denial ## Files - `src/packages/com_mokoog/src/Controller/BatchController.php` - `src/packages/com_mokoog/src/Controller/ImportExportController.php`

jmiller added the priority: high security production-readiness labels 2026-05-31 01:18:58 +00:00

jmiller commented

2026-05-31 01:19:01 +00:00

Branch created: feature/37-batch-and-importexport-controllers-lack-

git fetch origin
git checkout feature/37-batch-and-importexport-controllers-lack-

Branch created: [`feature/37-batch-and-importexport-controllers-lack-`](https://git.mokoconsulting.tech/MokoConsulting/MokoJoomOpenGraph/src/branch/feature/37-batch-and-importexport-controllers-lack-) ```bash git fetch origin git checkout feature/37-batch-and-importexport-controllers-lack- ```

jmiller referenced this issue from a commit

2026-05-31 01:40:37 +00:00

fix(security): harden controllers, add site defaults, platform-specific OG tags

jmiller referenced this issue

2026-05-31 01:41:49 +00:00

Security hardening, site-wide OG defaults, platform-specific social tags #45

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoJoomOpenGraph#37