From 9f6a4f1cc62b4d68db644838ccfab2dac5de396e Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremy@37signals.com>
Date: Wed, 3 Dec 2025 13:00:49 -0800
Subject: [PATCH] Fix unauthorized column reordering

Users could reorder columns they didn't have access to. Fixed by
limiting ColumnScoped to User::Accessor#accessible_columns.

References https://hackerone.com/reports/3449905
---
 app/controllers/concerns/column_scoped.rb           |  2 +-
 app/models/user/accessor.rb                         |  1 +
 .../columns/left_positions_controller_test.rb       | 13 +++++++++++++
 .../columns/right_positions_controller_test.rb      | 13 +++++++++++++
 4 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/app/controllers/concerns/column_scoped.rb b/app/controllers/concerns/column_scoped.rb
index 92d0715fa..ca0585547 100644
--- a/app/controllers/concerns/column_scoped.rb
+++ b/app/controllers/concerns/column_scoped.rb
@@ -7,6 +7,6 @@ module ColumnScoped
 
   private
     def set_column
-      @column = Current.account.columns.find(params[:column_id])
+      @column = Current.user.accessible_columns.find(params[:column_id])
     end
 end
diff --git a/app/models/user/accessor.rb b/app/models/user/accessor.rb
index 352a9ecb2..a9cc5e459 100644
--- a/app/models/user/accessor.rb
+++ b/app/models/user/accessor.rb
@@ -4,6 +4,7 @@ module User::Accessor
   included do
     has_many :accesses, dependent: :destroy
     has_many :boards, through: :accesses
+    has_many :accessible_columns, through: :boards, source: :columns
     has_many :accessible_cards, through: :boards, source: :cards
     has_many :accessible_comments, through: :accessible_cards, source: :comments
 
diff --git a/test/controllers/columns/left_positions_controller_test.rb b/test/controllers/columns/left_positions_controller_test.rb
index 74cb49dc6..57810ca70 100644
--- a/test/controllers/columns/left_positions_controller_test.rb
+++ b/test/controllers/columns/left_positions_controller_test.rb
@@ -20,4 +20,17 @@ class Columns::LeftPositionsControllerTest < ActionDispatch::IntegrationTest
     assert_equal original_position_b, column_a.reload.position
     assert_equal original_position_a, column_b.reload.position
   end
+
+  test "users can only reorder columns in boards they have access to" do
+    column = columns(:writebook_in_progress)
+
+    post column_left_position_path(column), as: :turbo_stream
+    assert_response :success
+
+    boards(:writebook).update! all_access: false
+    boards(:writebook).accesses.revoke_from users(:kevin)
+
+    post column_left_position_path(column), as: :turbo_stream
+    assert_response :not_found
+  end
 end
diff --git a/test/controllers/columns/right_positions_controller_test.rb b/test/controllers/columns/right_positions_controller_test.rb
index 69dc0bfb6..8226950ea 100644
--- a/test/controllers/columns/right_positions_controller_test.rb
+++ b/test/controllers/columns/right_positions_controller_test.rb
@@ -20,4 +20,17 @@ class Columns::RightPositionsControllerTest < ActionDispatch::IntegrationTest
     assert_equal original_position_b, column_a.reload.position
     assert_equal original_position_a, column_b.reload.position
   end
+
+  test "users can only reorder columns in boards they have access to" do
+    column = columns(:writebook_triage)
+
+    post column_right_position_path(column), as: :turbo_stream
+    assert_response :success
+
+    boards(:writebook).update! all_access: false
+    boards(:writebook).accesses.revoke_from users(:kevin)
+
+    post column_right_position_path(column), as: :turbo_stream
+    assert_response :not_found
+  end
 end