Patched code sample

import sys

# A mock user class for demonstration purposes.
class MockUser:
    def __init__(self, is_admin=False):
        # In a real application, this would check user roles and permissions.
        self.permissions = {'SETTINGS'}
        if is_admin:
            self.permissions.add('ADMIN')

    def has_permission(self, permission_name):
        return permission_name in self.permissions

# This code represents a simplified version of the relevant pyLoad module
# after the vulnerability has been patched.
class PatchedConfigManager:
    """
    A code example representing the fix for CVE-2026-35586.

    The vulnerability existed because the ADMIN_ONLY_CORE_OPTIONS set
    contained incorrect names ('ssl_cert', 'ssl_key') and was missing
    'ssl_certchain'. This allowed any user with SETTINGS permission to
    modify these sensitive options.

    The fix involves correcting the option names to 'ssl_certfile' and
    'ssl_keyfile' and adding 'ssl_certchain' to the set, ensuring
    the admin-only check works as intended.
    """

    # VULNERABILITY FIX:
    # The option names 'ssl_cert' and 'ssl_key' have been corrected to
    # 'ssl_certfile' and 'ssl_keyfile'. The 'ssl_certchain' option has been added.
    # This ensures these sensitive options require admin privileges to be modified.
    ADMIN_ONLY_CORE_OPTIONS = {
        "folder",
        "chunks",
        "min_free_space",
        "max_downloads",
        "language",
        "proxy_url",
        "proxy_port",
        "proxy_user",
        "proxy_pass",
        "proxy_socks5",
        "ssl_certfile",   # Corrected from 'ssl_cert'
        "ssl_keyfile",    # Corrected from 'ssl_key'
        "ssl_certchain"   # Added to the admin-only set
    }

    def __init__(self):
        # A mock configuration dictionary
        self.config = {
            "ssl_certfile": "/etc/pyload/ssl.crt",
            "ssl_keyfile": "/etc/pyload/ssl.key",
            "ssl_certchain": "",
            "language": "en"
        }

    def set_config_value(self, user, option, value):
        """
        Sets a configuration value, performing authorization checks.
        This method now correctly protects admin-only SSL settings.
        """
        # A user must at least have SETTINGS permission
        if not user.has_permission('SETTINGS'):
            raise PermissionError("User does not have SETTINGS permission.")

        # This check is the core of the security control. Because the option names
        # in ADMIN_ONLY_CORE_OPTIONS are now correct, this check will no longer
        # fail for SSL-related options.
        if option in self.ADMIN_ONLY_CORE_OPTIONS:
            if not user.has_permission('ADMIN'):
                # This code block is now correctly triggered for non-admins
                # trying to change 'ssl_certfile', 'ssl_keyfile', or 'ssl_certchain'.
                raise PermissionError(
                    f"Admin privileges required to change core option '{option}'."
                )

        # If authorization passes, the value is set.
        print(f"Authorization successful. Setting '{option}' to '{value}'.")
        self.config[option] = value


if __name__ == '__main__':
    # --- Demonstration of the fix ---

    manager = PatchedConfigManager()
    admin_user = MockUser(is_admin=True)
    normal_user = MockUser(is_admin=False)

    print("--- Simulating a non-admin user ---")
    
    # 1. Attempt to change a regular setting (should succeed)
    try:
        print("\nAttempting to change 'language'...")
        manager.set_config_value(normal_user, "language", "de")
    except PermissionError as e:
        print(f"Error: {e}", file=sys.stderr)

    # 2. Attempt to change 'ssl_keyfile' (should be blocked by the fix)
    try:
        print("\nAttempting to change 'ssl_keyfile'...")
        manager.set_config_value(normal_user, "ssl_keyfile", "/tmp/malicious_key.pem")
    except PermissionError as e:
        print(f"SUCCESS (FIX DEMONSTRATED): Operation correctly blocked. Error: {e}")

    # 3. Attempt to change 'ssl_certchain' (should be blocked by the fix)
    try:
        print("\nAttempting to change 'ssl_certchain'...")
        manager.set_config_value(normal_user, "ssl_certchain", "/tmp/malicious_chain.pem")
    except PermissionError as e:
        print(f"SUCCESS (FIX DEMONSTRATED): Operation correctly blocked. Error: {e}")

    print("\n\n--- Simulating an admin user ---")
    # 4. Admin user attempts to change 'ssl_keyfile' (should succeed)
    try:
        print("\nAttempting to change 'ssl_keyfile'...")
        manager.set_config_value(admin_user, "ssl_keyfile", "/etc/pyload/new_ssl.key")
    except PermissionError as e:
        print(f"Error: {e}", file=sys.stderr)

    print("\nFinal configuration:", manager.config)