Unauthorized Post Creation Across Organizations

[krishna619]

Describe the bug
I observed that changing the organizationId parameter allows a user to create a post in an organization to which they do not belong. This behavior poses a security risk as it allows unauthorized access to post creation across different organizations.

To Reproduce
Steps to reproduce the behavior:

1. Intercept the createPost request.
2. Change the value organizationId field to some other valid organization.

createpost_owatu8Yf.mp4

Screenshots
If applicable, add screenshots to help explain your problem.

Additional details
Add any other context or screenshots about the feature request here.

Potential internship candidates
Please read this if you are planning to apply for a Palisadoes Foundation internship PalisadoesFoundation/talawa#359

[krishna619]

1. I can remove any org even if I do not belong to that org.
2. I can disable any plugin even if I do not belong to that org.

[takshakmudgal]

I'd like to work on this issue.

[takshakmudgal]

Been busy working on PalisadoesFoundation/talawa-admin#1676 will take up #1959 soon.

[github-actions]

This issue did not get any activity in the past 10 days and will be closed in 180 days if no update occurs. Please check if the develop branch has fixed it and report again or close the issue.

[palisadoes]

Unassigning no activity

[Manik2708]

Can I work on this? @palisadoes @Cioppolo14

[Manik2708]

1. I can remove any org even if I do not belong to that org.

2. I can disable any plugin even if I do not belong to that org.

1. You must be logged in with SUPERADMIN. I can see in the code, only superadmin can remove the organization. If it's not superadmin then an error is thrown.
2. I can't find mutation to disable plugin. Can you help me with finding it?

[palisadoes]

@SiddheshKukade Please assist with the plugin question

[Manik2708]

After searching a bit, I found a mutation named updatePluginStatus. Are you talking about this? @krishna619

[krishna619]

there is a mutation called blockPluginCreationBySuperAdmin, and I feel after the userType merge, it has been handled.

Manik2708

[Manik2708]

there is a mutation called blockPluginCreationBySuperAdmin, and I feel after the userType merge, it has been handled.

Manik2708

As the name suggests, it can only be done by SUPERADMIN, so it doesn't need to be the member of organization.