Bugzilla – Attachment 6897 Details for
Bug 6627
[security] insecure file creation
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Patch to ensure higher security with relation to log files
0001-Update-to-improve-security-in-specified-log-files-bu.patch (text/plain), 4.01 KB, created by
Duncan
on 2011-12-21 02:14:24 UTC
(
hide
)
Description:
Patch to ensure higher security with relation to log files
Filename:
MIME Type:
Creator:
Duncan
Created:
2011-12-21 02:14:24 UTC
Size:
4.01 KB
patch
obsolete
>From eb4bf83615255ed612de2a5f2deae13862c5ffcc Mon Sep 17 00:00:00 2001 >From: Duncan Tyler <duncan@catalyst.net.nz> >Date: Wed, 21 Dec 2011 14:59:21 +1300 >Subject: [PATCH] Update to improve security in specified log files - bug 6627 > >--- > C4/Auth.pm | 8 ++++---- > C4/Print.pm | 10 +++++++++- > installer/InstallAuth.pm | 3 ++- > 3 files changed, 15 insertions(+), 6 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index e360e10..bbe472b 100755 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -703,7 +703,7 @@ sub checkauth { > $session->flush; > $session->delete(); > C4::Context->_unset_userenv($sessionID); >- _session_log(sprintf "%20s from %16s logged out at %30s (manually).\n", $userid,$ip,(strftime "%c",localtime)); >+ #_session_log(sprintf "%20s from %16s logged out at %30s (manually).\n", $userid,$ip,(strftime "%c",localtime)); > $sessionID = undef; > $userid = undef; > >@@ -716,7 +716,7 @@ sub checkauth { > $info{'timed_out'} = 1; > $session->delete(); > C4::Context->_unset_userenv($sessionID); >- _session_log(sprintf "%20s from %16s logged out at %30s (inactivity).\n", $userid,$ip,(strftime "%c",localtime)); >+ #_session_log(sprintf "%20s from %16s logged out at %30s (inactivity).\n", $userid,$ip,(strftime "%c",localtime)); > $userid = undef; > $sessionID = undef; > } >@@ -727,7 +727,7 @@ sub checkauth { > $info{'different_ip'} = 1; > $session->delete(); > C4::Context->_unset_userenv($sessionID); >- _session_log(sprintf "%20s from %16s logged out at %30s (ip changed to %16s).\n", $userid,$ip,(strftime "%c",localtime), $info{'newip'}); >+ #_session_log(sprintf "%20s from %16s logged out at %30s (ip changed to %16s).\n", $userid,$ip,(strftime "%c",localtime), $info{'newip'}); > $sessionID = undef; > $userid = undef; > } >@@ -765,7 +765,7 @@ sub checkauth { > $userid = $retuserid if ($retuserid ne ''); > } > if ($return) { >- _session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); >+ #_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); > if ( $flags = haspermission( $userid, $flagsrequired ) ) { > $loggedin = 1; > } >diff --git a/C4/Print.pm b/C4/Print.pm >index 2ba7584d..f810816 100644 >--- a/C4/Print.pm >+++ b/C4/Print.pm >@@ -79,7 +79,8 @@ sub remoteprint ($$) { > # to have spaces in them). Or perhaps if $queue eq "" and > # $env->{file} ne "", then that should mean "print to $env->{file}". > if ( $queue eq "" || $queue eq 'nulllp' ) { >- open( PRINTER, ">/tmp/kohaiss" ); >+ return; >+ #open( PRINTER, ">/tmp/kohaiss" ); > } > else { > >@@ -125,6 +126,10 @@ sub remoteprint ($$) { > } > > sub printreserve { >+ >+ # FIXME - make useful >+ return; >+ > my ( $branchname, $bordata, $itemdata ) = @_; > my $printer = ''; > (return) unless ( C4::Context->boolean_preference('printreserveslips') ); >@@ -175,6 +180,9 @@ print a slip for the given $borrowernumber > > #' > sub printslip ($) { >+ >+ #FIXME - make useful >+ > my $borrowernumber = shift; > my $borrower = GetMemberDetails($borrowernumber); > my $issueslist = GetPendingIssues($borrowernumber); >diff --git a/installer/InstallAuth.pm b/installer/InstallAuth.pm >index 10cbea3..ccdcbcb 100644 >--- a/installer/InstallAuth.pm >+++ b/installer/InstallAuth.pm >@@ -274,7 +274,8 @@ sub checkauth { > C4::Context->_unset_userenv($sessionID); > $sessionID = undef; > $userid = undef; >- open L, ">>/tmp/sessionlog"; >+ # Commented out due to its lack of usefulness >+ # open L, ">>/tmp/sessionlog"; > my $time = localtime( time() ); > printf L "%20s from %16s logged out at %30s (manually).\n", $userid, > $ip, $time; >-- >1.7.5.4 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 6627
:
6897
|
6984