Fix BOLA (Broken Object Level Authorization) in TurboGears

BOLA (Broken Object Level Authorization) is the bread and butter of API exploitation. In TurboGears, this typically manifests when a controller action fetches a model instance directly from the DBSession using a user-supplied ID without verifying that the authenticated user actually owns that resource. To kill BOLA, you must move beyond simple authentication and implement resource-level ownership checks in every data-fetching routine.

The Vulnerable Pattern

from tg import expose, request
from myapp.model import DBSession, Document
class DocumentController(BaseController):
@expose(‘json’)
def get_document(self, doc_id):
# VULNERABLE: Directly fetching by ID without checking ownership
doc = DBSession.query(Document).filter_by(id=doc_id).one_or_none()
if not doc:
return dict(error=‘Not found’)
return dict(content=doc.content)

The Secure Implementation

The fix shifts authorization from the application logic to the database query itself. By appending 'owner_id=user.id' to the SQLAlchemy filter, the database engine ensures that only records belonging to the requester are retrieved. This prevents 'Insecure Direct Object Reference' (IDOR) because even if an attacker guesses a valid 'doc_id', the query will return null if they do not own it. Always use 'request.identity' to retrieve the server-side session user rather than trusting any user-provided user_id in the payload.

from tg import expose, request, abort
from myapp.model import DBSession, Document
class DocumentController(BaseController):
@expose(‘json’)
def get_document(self, doc_id):
# SECURE: Scoping the query to the authenticated user’s ID
user = request.identity[‘user’]
doc = DBSession.query(Document).filter_by(
id=doc_id,
owner_id=user.id
).one_or_none()
    if not doc:
        # Use 403 or 404 to prevent ID enumeration/leaks
        abort(403, detail='Permission denied or resource does not exist')
        
    return dict(content=doc.content)</code></pre>