Merge pull request #919 from GhostManager/hotfix/template-swap

Hotfix: Template swap security

Author: chrismaddalena

CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [7.1.2] - 24 June 2026
+
+### Fixed
+
+* Fixed `datetime-local` rendering for white card and deconfliction edit forms so saved timestamps display reliably in older browsers (Closes #917)
+
+### Security
+
+* Fixed additional client-scoped report template authorization bypasses in template swapping, report generation, archive generation, linting, and lint result endpoints
+  * Report template selection now only accepts global templates or templates scoped to the report project's client
+  * This fix includes two temporary breaking changes for the API while we work on a custom endpoint to handle this new business logic:
+    * **Breaking:** The GraphQL API no longer allows `user` or `manager` roles to set report template ID columns directly when creating or updating reports
+    * **Breaking:** The GraphQL API no longer allows `user` or `manager` roles to update a report's project ID column directly
+
 ## [7.1.1] - 18 June 2026
 
 ### Fixed

VERSION

@@ -1,2 +1,2 @@
-v7.1.1
-18 June 2026
+v7.1.2
+24 June 2026

config/settings/base.py

@@ -11,9 +11,9 @@
 # 3rd Party Libraries
 import environ
 
-__version__ = "7.1.1"
+__version__ = "7.1.2"
 VERSION = __version__
-RELEASE_DATE = "18 June 2026"
+RELEASE_DATE = "24 June 2026"
 
 ROOT_DIR = Path(__file__).resolve(strict=True).parent.parent.parent
 APPS_DIR = ROOT_DIR / "ghostwriter"

ghostwriter/api/tests/test_hasura_metadata.py

@@ -735,3 +735,24 @@ def test_library_write_permissions_require_user_feature_flags(self):
                     user_feature_flag_check(feature_flag),
                     f"{filename} {permission_type}",
                 )
+
+    def test_report_template_assignments_are_not_graphql_writable(self):
+        table = load_yaml(HASURA_TABLE_DIR / "public_reporting_report.yaml")
+        template_columns = {"docx_template_id", "pptx_template_id"}
+
+        for role in ("manager", "user"):
+            for permission_type in ("insert_permissions", "update_permissions"):
+                permission = get_role_permission(table, role, permission_type)
+                writable_columns = set(permission["permission"].get("columns", []))
+                self.assertFalse(
+                    template_columns & writable_columns,
+                    f"{role} {permission_type}",
+                )
+
+    def test_report_project_is_not_graphql_updateable(self):
+        table = load_yaml(HASURA_TABLE_DIR / "public_reporting_report.yaml")
+
+        for role in ("manager", "user"):
+            permission = get_role_permission(table, role, "update_permissions")
+            writable_columns = set(permission["permission"].get("columns", []))
+            self.assertNotIn("project_id", writable_columns, role)

ghostwriter/commandcenter/forms.py

@@ -37,6 +37,11 @@ def __init__(self, *args, **kwargs):
     def clean_default_docx_template(self):
         docx_template = self.cleaned_data["default_docx_template"]
         if docx_template:
+            if docx_template.client_id is not None:
+                raise ValidationError(
+                    _("Global default Word templates cannot be scoped to a client"),
+                    "invalid",
+                )
             docx_template_status = docx_template.get_status()
             if docx_template_status in ("error", "failed"):
                 raise ValidationError(
@@ -48,6 +53,11 @@ def clean_default_docx_template(self):
     def clean_default_pptx_template(self):
         pptx_template = self.cleaned_data["default_pptx_template"]
         if pptx_template:
+            if pptx_template.client_id is not None:
+                raise ValidationError(
+                    _("Global default PowerPoint templates cannot be scoped to a client"),
+                    "invalid",
+                )
             pptx_template_status = pptx_template.get_status()
             if pptx_template_status in ("error", "failed"):
                 raise ValidationError(

ghostwriter/commandcenter/tests/test_forms.py

@@ -11,6 +11,7 @@
 from ghostwriter.commandcenter.models import ExtraFieldModel, ExtraFieldSpec
 from ghostwriter.commandcenter.forms import ExtraFieldsField, ExtraFieldsWidget, ReportConfigurationForm
 from ghostwriter.factories import (
+    ClientFactory,
     ExtraFieldSpecFactory,
     ReportConfigurationFactory,
     ReportDocxTemplateFactory,
@@ -127,6 +128,13 @@ def test_clean_default_docx_template(self):
         self.assertEqual(len(errors), 1)
         self.assertEqual(errors[0].code, "invalid")
 
+        config["default_docx_template_id"] = ReportDocxTemplateFactory(client=ClientFactory()).pk
+
+        form = self.form_data(**config)
+        errors = form.errors["default_docx_template"].as_data()
+        self.assertEqual(len(errors), 1)
+        self.assertEqual(errors[0].code, "invalid_choice")
+
     def test_clean_default_pptx_template(self):
         config = self.config.__dict__.copy()
         form = self.form_data(**config)
@@ -140,6 +148,13 @@ def test_clean_default_pptx_template(self):
         self.assertEqual(len(errors), 1)
         self.assertEqual(errors[0].code, "invalid")
 
+        config["default_pptx_template_id"] = ReportPptxTemplateFactory(client=ClientFactory()).pk
+
+        form = self.form_data(**config)
+        errors = form.errors["default_pptx_template"].as_data()
+        self.assertEqual(len(errors), 1)
+        self.assertEqual(errors[0].code, "invalid_choice")
+
     def test_clean_outline_tags_normalizes_and_deduplicates_rules(self):
         config = self.config.__dict__.copy()
         config["outline_tags"] = " report , EVIDENCE, cred* , att&ck: , cred* , ATT&CK:* ,, "

ghostwriter/reporting/archive.py

@@ -24,6 +24,10 @@ def archive_report(report: Report):
         raise MissingTemplate()
     if not pptx_template:
         raise MissingTemplate()
+    if not docx_template.can_apply_to_report(report, "docx"):
+        raise ValueError("The selected Word template is not available for this report.")
+    if not pptx_template.can_apply_to_report(report, "pptx"):
+        raise ValueError("The selected PowerPoint template is not available for this report.")
     filename = "archives/" + "".join(c for c in report.title if c.isalpha() or c.isdigit() or c == ' ') + ".zip"
     evidences = report.all_evidences()
 

ghostwriter/reporting/forms.py

@@ -45,6 +45,16 @@
 )
 from ghostwriter.rolodex.models import Project
 
+
+def _report_template_queryset(doc_type, project=None):
+    queryset = ReportTemplate.objects.filter(
+        doc_type__doc_type__iexact=doc_type,
+    ).select_related("doc_type", "client")
+    if project:
+        return queryset.filter(Q(client_id=project.client_id) | Q(client__isnull=True))
+    return queryset.filter(client__isnull=True)
+
+
 class AssignReportFindingForm(forms.ModelForm):
     class Meta:
         model = ReportFindingLink
@@ -131,6 +141,17 @@ def __init__(self, user=None, project=None, *args, **kwargs):
                 lambda obj: f"{obj.start_date} {obj.client.name} {obj.project_type} ({obj.codename})"
             )
 
+        selected_project = project
+        if selected_project is None and getattr(self.instance, "project_id", None):
+            selected_project = self.instance.project
+        if self.is_bound and not self.fields["project"].disabled:
+            project_id = self.data.get(self.add_prefix("project"))
+            if project_id:
+                try:
+                    selected_project = self.fields["project"].queryset.filter(pk=project_id).first()
+                except (TypeError, ValueError):
+                    selected_project = None
+
         for field in self.fields:
             self.fields[field].widget.attrs["autocomplete"] = "off"
         self.fields["docx_template"].label = "DOCX Template"
@@ -141,8 +162,17 @@ def __init__(self, user=None, project=None, *args, **kwargs):
         self.fields["title"].widget.attrs["placeholder"] = "Red Team Report for Project Foo"
 
         report_config = ReportConfiguration.get_solo()
-        self.fields["docx_template"].initial = report_config.default_docx_template
-        self.fields["pptx_template"].initial = report_config.default_pptx_template
+        template_fields = (
+            ("docx_template", "docx", report_config.default_docx_template),
+            ("pptx_template", "pptx", report_config.default_pptx_template),
+        )
+        for field_name, doc_type, default_template in template_fields:
+            self.fields[field_name].queryset = _report_template_queryset(doc_type, selected_project)
+            if default_template and (
+                default_template.client_id is None
+                or (selected_project and default_template.can_apply_to_project(selected_project))
+            ):
+                self.fields[field_name].initial = default_template
         self.fields["docx_template"].empty_label = "-- Pick a Word Template --"
         self.fields["pptx_template"].empty_label = "-- Pick a PowerPoint Template --"
 
@@ -575,6 +605,8 @@ def __init__(self, *args, **kwargs):
         self.fields["docx_template"].required = False
         self.fields["pptx_template"].help_text = None
         self.fields["pptx_template"].required = False
+        self.fields["docx_template"].queryset = _report_template_queryset("docx", self.instance.project)
+        self.fields["pptx_template"].queryset = _report_template_queryset("pptx", self.instance.project)
         self.fields["docx_template"].empty_label = "-- Select a DOCX Template --"
         self.fields["pptx_template"].empty_label = "-- Select a PPTX Template --"
         self.fields["include_bloodhound_data"].required = False

ghostwriter/reporting/models.py

@@ -451,6 +451,21 @@ def user_can_view(self, user) -> bool:
             return True
         return self.client.user_can_view(user)
 
+    def can_apply_to_project(self, project) -> bool:
+        """Return whether this template is global or scoped to the project's client."""
+        return self.client_id is None or self.client_id == project.client_id
+
+    def can_apply_to_report(self, report, doc_type=None) -> bool:
+        """Return whether this template's client and optional document type match a report."""
+        doc_type_matches = doc_type is None or (
+            self.doc_type_id is not None and self.doc_type.doc_type.lower() == doc_type.lower()
+        )
+        return doc_type_matches and self.can_apply_to_project(report.project)
+
+    def user_can_apply_to_report(self, user, report, doc_type=None) -> bool:
+        """Return whether the user can view this template and apply it to the report."""
+        return self.user_can_view(user) and self.can_apply_to_report(report, doc_type)
+
     def get_effective_evidence_image_alignment(self, report_config):
         template_alignment = _text_choice_from_stored_value(
             EvidenceImageAlignmentOverride, self.evidence_image_alignment

ghostwriter/reporting/tests/test_forms.py

@@ -6,6 +6,8 @@
 
 # Ghostwriter Libraries
 from ghostwriter.factories import (
+    ClientFactory,
+    DocTypeFactory,
     EvidenceOnFindingFactory,
     EvidenceOnReportFactory,
     FindingNoteFactory,
@@ -16,6 +18,7 @@
     ReportFindingLinkFactory,
     ReportObservationLinkFactory,
     ReportDocxTemplateFactory,
+    ReportPptxTemplateFactory,
     SeverityFactory,
     UserFactory,
 )
@@ -104,6 +107,111 @@ def test_invalid_pptx_template(self):
         self.assertEqual(len(errors), 1)
         self.assertEqual(errors[0].code, "invalid_choice")
 
+    def test_client_scoped_templates_are_limited_to_selected_project_client(self):
+        ProjectAssignmentFactory(operator=self.user, project=self.project)
+        same_client_docx = ReportDocxTemplateFactory(client=self.project.client)
+        same_client_pptx = ReportPptxTemplateFactory(client=self.project.client)
+        foreign_docx = ReportDocxTemplateFactory(client=ClientFactory())
+        foreign_pptx = ReportPptxTemplateFactory(client=ClientFactory())
+
+        form = self.form_data(
+            user=self.user,
+            title="Scoped Template Report",
+            archived=False,
+            project_id=self.project.pk,
+            docx_template_id=same_client_docx.pk,
+            pptx_template_id=same_client_pptx.pk,
+            delivered=False,
+        )
+
+        self.assertTrue(form.is_valid(), form.errors)
+        self.assertIn(same_client_docx, form.fields["docx_template"].queryset)
+        self.assertIn(same_client_pptx, form.fields["pptx_template"].queryset)
+        self.assertNotIn(foreign_docx, form.fields["docx_template"].queryset)
+        self.assertNotIn(foreign_pptx, form.fields["pptx_template"].queryset)
+
+    def test_client_scoped_template_for_other_client_is_invalid(self):
+        ProjectAssignmentFactory(operator=self.user, project=self.project)
+        foreign_docx = ReportDocxTemplateFactory(client=ClientFactory())
+        foreign_pptx = ReportPptxTemplateFactory(client=ClientFactory())
+
+        form = self.form_data(
+            user=self.user,
+            title="Foreign Template Report",
+            archived=False,
+            project_id=self.project.pk,
+            docx_template_id=foreign_docx.pk,
+            pptx_template_id=foreign_pptx.pk,
+            delivered=False,
+        )
+
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form["docx_template"].errors.as_data()[0].code, "invalid_choice")
+        self.assertEqual(form["pptx_template"].errors.as_data()[0].code, "invalid_choice")
+
+    def test_disabled_project_field_ignores_submitted_project_for_template_choices(self):
+        ProjectAssignmentFactory(operator=self.user, project=self.project)
+        other_project = ProjectFactory()
+        other_docx = ReportDocxTemplateFactory(client=other_project.client)
+        other_pptx = ReportPptxTemplateFactory(client=other_project.client)
+
+        form = ReportForm(
+            user=self.user,
+            project=self.project,
+            instance=self.report,
+            data={
+                "title": "Crafted Report Update",
+                "archived": False,
+                "project": other_project.pk,
+                "docx_template": other_docx.pk,
+                "pptx_template": other_pptx.pk,
+                "delivered": False,
+            },
+        )
+
+        self.assertTrue(form.fields["project"].disabled)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form["docx_template"].errors.as_data()[0].code, "invalid_choice")
+        self.assertEqual(form["pptx_template"].errors.as_data()[0].code, "invalid_choice")
+
+    def test_template_choices_ignore_inaccessible_submitted_project(self):
+        ProjectAssignmentFactory(operator=self.user, project=self.project)
+        inaccessible_project = ProjectFactory()
+        inaccessible_docx = ReportDocxTemplateFactory(client=inaccessible_project.client)
+        inaccessible_pptx = ReportPptxTemplateFactory(client=inaccessible_project.client)
+
+        form = self.form_data(
+            user=self.user,
+            title="Inaccessible Project Template Report",
+            archived=False,
+            project_id=inaccessible_project.pk,
+            docx_template_id=inaccessible_docx.pk,
+            pptx_template_id=inaccessible_pptx.pk,
+            delivered=False,
+        )
+
+        self.assertFalse(form.fields["project"].disabled)
+        self.assertNotIn(inaccessible_docx, form.fields["docx_template"].queryset)
+        self.assertNotIn(inaccessible_pptx, form.fields["pptx_template"].queryset)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form["project"].errors.as_data()[0].code, "invalid_choice")
+        self.assertEqual(form["docx_template"].errors.as_data()[0].code, "invalid_choice")
+        self.assertEqual(form["pptx_template"].errors.as_data()[0].code, "invalid_choice")
+
+    def test_template_choices_handle_non_integer_submitted_project(self):
+        form = self.form_data(
+            user=self.user,
+            title="Invalid Project Template Report",
+            archived=False,
+            project_id="not-a-project-id",
+            docx_template_id=self.report.docx_template.pk,
+            pptx_template_id=self.report.pptx_template.pk,
+            delivered=False,
+        )
+
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form["project"].errors.as_data()[0].code, "invalid_choice")
+
 
 class ReportObservationLinkUpdateFormTests(TestCase):
     """Collection of tests for :form:`reporting.ReportObservationLinkForm`."""
@@ -486,6 +594,48 @@ def test_mismatch_pptx_template(self):
         self.assertEqual(len(errors), 1)
         self.assertEqual(errors[0].code, "invalid_choice")
 
+    def test_client_scoped_template_for_other_client_is_invalid(self):
+        foreign_docx = ReportDocxTemplateFactory(client=ClientFactory())
+        foreign_pptx = ReportPptxTemplateFactory(client=ClientFactory())
+
+        form = self.form_data(
+            instance=self.report,
+            docx_template=foreign_docx.pk,
+            pptx_template=foreign_pptx.pk,
+        )
+
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form["docx_template"].errors.as_data()[0].code, "invalid_choice")
+        self.assertEqual(form["pptx_template"].errors.as_data()[0].code, "invalid_choice")
+
+    def test_client_scoped_template_for_report_client_is_valid(self):
+        docx_template = ReportDocxTemplateFactory(client=self.report.project.client)
+        pptx_template = ReportPptxTemplateFactory(client=self.report.project.client)
+
+        form = self.form_data(
+            instance=self.report,
+            docx_template=docx_template.pk,
+            pptx_template=pptx_template.pk,
+        )
+
+        self.assertTrue(form.is_valid(), form.errors)
+
+    def test_mixed_case_document_type_templates_are_valid(self):
+        docx_type = DocTypeFactory(doc_type="DoCx", extension="docx", name="DoCx")
+        pptx_type = DocTypeFactory(doc_type="PpTx", extension="pptx", name="PpTx")
+        docx_template = ReportDocxTemplateFactory(doc_type=docx_type)
+        pptx_template = ReportPptxTemplateFactory(doc_type=pptx_type)
+
+        form = self.form_data(
+            instance=self.report,
+            docx_template=docx_template.pk,
+            pptx_template=pptx_template.pk,
+        )
+
+        self.assertIn(docx_template, form.fields["docx_template"].queryset)
+        self.assertIn(pptx_template, form.fields["pptx_template"].queryset)
+        self.assertTrue(form.is_valid(), form.errors)
+
 
 class SeverityFormTests(TestCase):
     """Collection of tests for :form:`reporting.SeverityForm`."""