Bug 11612 - 404 error page for Intranet may leak information
Summary: 404 error page for Intranet may leak information
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-01-26 23:01 UTC by Isaac Brodsky
Modified: 2022-12-06 05:44 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Isaac Brodsky 2014-01-26 23:01:06 UTC 
Navigating to an non-existent page on the intranet site, (e.g. https://demo-admin.calyx.net.au/test) allows an unauthenticated user to see the top nav bar. If an administrator uses IntranetNav configuration option to add links to the NavBar, those links will be displayed to unauthenticated users.

I do not believe any part of the staff client should be visible to unauthenticated users. Administrators might assume no part of it is visible since the login screen completely hides the regular staff interface.

Tested on Debian with Koha 3.14.

Isaac
Comment 1 Owen Leonard 2016-06-23 13:59:12 UTC 
Still valid in master.
Comment 2 David Cook 2022-12-06 05:44:10 UTC 
Agreed with Isaac. Unauthenticated users shouldn't be able to see anything other than 401 or the login screen.

Since we're using Plack::App::CGIBin, I think the only way to deal with this might be to add a Middleware to check if the user is authenticated before returning the 404. 

Something to think about but certainly relevant.