Bugzilla – Attachment 100837 Details for
Bug 24878
Authentication check missing on calendar tools
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 24878: Add authentication checks to the calendar tool
Bug-24878-Add-authentication-checks-to-the-calenda.patch (text/plain), 2.26 KB, created by
Bernardo Gonzalez Kriegel
on 2020-03-16 23:53:50 UTC
(
hide
)
Description:
Bug 24878: Add authentication checks to the calendar tool
Filename:
MIME Type:
Creator:
Bernardo Gonzalez Kriegel
Created:
2020-03-16 23:53:50 UTC
Size:
2.26 KB
patch
obsolete
>From df7a8bb4c901e11a3ab84da7757d329c79f921e2 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Mon, 16 Mar 2020 16:26:48 +0100 >Subject: [PATCH] Bug 24878: Add authentication checks to the calendar tool > >There is a security hole in 2 scripts that are used by the UI to edit >holidays. > >To test: >1) Go to Tools -> Calendar, for Centerville > Check no holiday for 30/4/2020 >2) To add a new holiday without login execute > > curl -d "newBranchName=CPL&showDayname=Mondays&newWeekday=1&newDay=30&newMonth=3&newYear=2020&dateofrange=27%2F03%2F2020&newTitle=Test+holiday&newDescription=Holy+description&newOperation=holiday&submit=Save" -H "Content-Type: application/x-www-form-urlencoded" -X POST http://staff/cgi-bin/koha/tools/newHolidays.pl > > Where 'staff' is your host:port > This adds a new holiday for CPL (Centerville) on 30/4/2020 >3) Reload page from 1), verify the new holiday > edit and delete the holiday >4) Apply the patch >5) Do 2) again, this time you get a lengthy output, > with the magic words: > > <title>Koha › > Log in to Koha > </title> > >Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com> >Only tested newHoliday but the fix is the same. >No errors >--- > tools/exceptionHolidays.pl | 3 +++ > tools/newHolidays.pl | 2 ++ > 2 files changed, 5 insertions(+) > >diff --git a/tools/exceptionHolidays.pl b/tools/exceptionHolidays.pl >index 90b17bc6cf..1f3b9672fb 100755 >--- a/tools/exceptionHolidays.pl >+++ b/tools/exceptionHolidays.pl >@@ -14,6 +14,9 @@ use Koha::DateUtils; > my $input = new CGI; > my $dbh = C4::Context->dbh(); > >+checkauth($input, 0, {tools=> 'edit_calendar'}, 'intranet'); >+ >+ > my $branchcode = $input->param('showBranchName'); > my $weekday = $input->param('showWeekday'); > my $day = $input->param('showDay'); >diff --git a/tools/newHolidays.pl b/tools/newHolidays.pl >index a161eaf1c8..f13e52447b 100755 >--- a/tools/newHolidays.pl >+++ b/tools/newHolidays.pl >@@ -33,6 +33,8 @@ use Koha::DateUtils; > my $input = new CGI; > my $dbh = C4::Context->dbh(); > >+checkauth($input, 0, {tools=> 'edit_calendar'}, 'intranet'); >+ > our $branchcode = $input->param('newBranchName'); > my $originalbranchcode = $branchcode; > our $weekday = $input->param('newWeekday'); >-- >2.17.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 24878
:
100764
|
100837
|
100882
|
100883
|
100884