Which mean unauthorized users can edit (add/edit/delete) holidays.
Created attachment 100764 [details] [review] Bug 24878: Add authentication checks to the calendar tool There is a security hole in 2 scripts that are used by the UI to edit holidays.
The lack of test plan is expected here, curl is your friend...
(In reply to Jonathan Druart from comment #2) > The lack of test plan is expected here, curl is your friend... Not sure I agree here...
(In reply to Katrin Fischer from comment #3) > (In reply to Jonathan Druart from comment #2) > > The lack of test plan is expected here, curl is your friend... > > Not sure I agree here... I would have tested this with a test plan, but it's really too late here to learn curl and how to apply it to this patch correctly.
Created attachment 100837 [details] [review] Bug 24878: Add authentication checks to the calendar tool There is a security hole in 2 scripts that are used by the UI to edit holidays. To test: 1) Go to Tools -> Calendar, for Centerville Check no holiday for 30/4/2020 2) To add a new holiday without login execute curl -d "newBranchName=CPL&showDayname=Mondays&newWeekday=1&newDay=30&newMonth=3&newYear=2020&dateofrange=27%2F03%2F2020&newTitle=Test+holiday&newDescription=Holy+description&newOperation=holiday&submit=Save" -H "Content-Type: application/x-www-form-urlencoded" -X POST http://staff/cgi-bin/koha/tools/newHolidays.pl Where 'staff' is your host:port This adds a new holiday for CPL (Centerville) on 30/4/2020 3) Reload page from 1), verify the new holiday edit and delete the holiday 4) Apply the patch 5) Do 2) again, this time you get a lengthy output, with the magic words: <title>Koha › Log in to Koha </title> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com> Only tested newHoliday but the fix is the same. No errors
I personally do not think we should provide/publish a command that could be easily reused.
If you set the comment to private, only a select group will be able to see it even once the bug is published.
Created attachment 100882 [details] [review] Bug 24878: Add authentication checks to the calendar tool There is a security hole in 2 scripts that are used by the UI to edit holidays. To test: 1) Go to Tools -> Calendar, for Centerville Check no holiday for 30/4/2020 2) To add a new holiday without login execute a curl command with necessary parameters 3) Reload page from 1), verify the new holiday edit and delete the holiday 4) Apply the patch 5) Do 2) again, this time you get a lengthy output, with the magic words: <title>Koha › Log in to Koha </title> Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com> Only tested newHoliday but the fix is the same. No errors Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 100883 [details] [review] Bug 24878: Add auth check for copy-holidays
Created attachment 100884 [details] [review] Bug 24878: Add auth check for copy-holidays Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(In reply to Jonathan Druart from comment #6) > I personally do not think we should provide/publish a command that could be > easily reused. You are right, sorry. Joust wanted to show how it could be tested. I found my way using tcpdump and wireshark.
Pushed to 19.11.x branch for 19.11.04
Backported to 18.11.x for 18.11.15
backported to 19.05.x for 19.05.09
Pushed to master