EntityHome and Hibernate Filters

[jmatters]

Hello,

I've got some unexpected behaviour with a hibernate filter in my seam application.

As long as the application is used normally the filter acts as expected. It seems as though all queries conducted through EntityQuery objects (for lists etc.) get the where clause set correctly by the filter. Therefore only elements that match the filter criteria are displayed to the user.

But for queries triggered by EntityHome objects the filter where clause is not set!

This means, by simply changing a request parameter id for an EntityHome object manually in the URL, the user gets a view of the object even though the filter parameter would not allow that.

I would have expected the filter to be more rigorous... I would actually consider that as a serious security flaw as I've read that quite a few applications use filters for separating data in multi tenant applications.

Is there any way to restrict these queries to the filter values? Or is this really a bug?

- Chris

[jmatters]

bounce ... nobody woried about parameter injection and hibernate filters?

[jmatters]

bounce again... The number of views on this post tell me I schould have chosen a catchier title.

I'd just love to get a comment on this by the community or the Seam Team!
I can post some details from Hibernate logging to explain what I think is happening.

- Chris

[pmuir]

We need some time to look into it, its on my todo list.

[christian.bauer]

Folks, it's supposed to work like this. Hibernate filters do not filter retrieval by identifier (it's your fault if you expose identifiers to malicious users), retrieval of proxies, many-to-one and one-to-one associations. If you want stuff filtered, use HQL, Criteria, or collection filters. Yes, there is a reason why it is like that.

Take this onto the Hibernate forum, this is the wrong place.

[christian.bauer]

And examples/wiki/ shows you how to do it properly.