known issue Wrong attachment claiming=> temp key in core_attachments_map is not unique!!

[derpunker]

Dear IPS support,

I have found a bug in context of the attachment claiming.

IPS 4.7.9 installed, all hooks disabled.

 

-------

Repro steps:

1. Login with user 1 (user)
2. Create a new topic
3. Add an attachment, for example a picture, to the post
4. Leaf the title empty
5. Try to save the new topic => Error, because of missing field (Topic should not be saved)
6. Logout user 1 (user)
7. Login with user 2 (root)
8. Create a new topic (same forum as before)
9. Add an attachment, for example a picture, to the post
10. Leaf the title empty
11. Try to save the new topic => Error, because of missing field
12. Fill in a title
13. Save the new topic

Result:

• The topic iteself is created correct
• In the activity stream the post is displayed wrong! The picture of user 1 is assigned to the post of user 2.

 

Technical analyze:

The temp key in core_attachments_map is a md5 hash based on the same input string. The string is more or less constant for a forum and doesn't contain a session or user id.

 

 

The two screenrecording are showing the bug.

Scenario with 2 pictures

 

Scenarion with only one picture

 

Please have a look with high priority.
My community has already many posts with inconsistant attachments 😥

 

 

 

Edited May 6 by derpunker

[Jim M]

Are you stating that this happens with other users in real life terms? I.E., not logging in/out of accounts on the same machine.

[derpunker]

Yes, this happens with different users in real life too.

We have observed this bug a couple of times in our community with normal user accounts and it took some time to understand the scenario.

 

In this video a VM and the Host itself is used.
Please ignore the license warning, this is only because of not using localhost.

 

 

The repros steps are really simple, please try it out by yourself @Jim M

[Jim M]

Please be advised I have tagged a developer to review your claims here.

[derpunker]

Reproduced in your live community.

 

@Jim M

Edited May 8 by derpunker

[derpunker]

Any feedback so far?

[Marc Stridgen]

Thank you for bringing this issue to our attention! I can confirm this should be further reviewed and I have logged an internal bug report for our development team to investigate and address as necessary, in a future maintenance release.