Bug 27716 - Insufficient access control for printer profiles
Summary: Insufficient access control for printer profiles
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: System Administration (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low minor
Assignee: Martin Renvoize (ashimema)
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-02-17 11:31 UTC by Martin Renvoize (ashimema)
Modified: 2021-12-13 21:11 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
This change moves the label creator pages, including the printer profiles management, under the 'lable_creator' permission under tools. This gives a more refined access permission for this area of functionality.
Version(s) released in:
21.05.00,20.11.04
Circulation function:

Attachments
Bug 27716: Update permissions for patroncards creator (6.16 KB, patch)
2021-02-19 10:17 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 27716: Update permissions for patroncards creator (6.21 KB, patch)
2021-02-23 11:55 UTC, Owen Leonard 		Details | Diff | Splinter Review
Bug 27716: Update permissions for patroncards creator (6.21 KB, patch)
2021-03-04 16:01 UTC, Katrin Fischer 		Details | Diff | Splinter Review
Bug 27716: Update permissions for patroncards creator (6.27 KB, patch)
2021-03-04 16:03 UTC, Katrin Fischer 		Details | Diff | Splinter Review
Show Obsolete (3) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize (ashimema) 2021-02-17 11:31:15 UTC 
A low privileged staff user (i.e. one with just the 'catalogue' permission to enable logging into the staff client) can access and change/add/delete printer profiles.  This functionality should be behind an escalated privilege.
Comment 1 Jonathan Druart 2021-02-18 10:22:42 UTC 
% git grep flagsrequired patroncards                                                                                                                        [11:20:56]
patroncards/add_user_search.pl:        flagsrequired   => { catalogue => 1 },
patroncards/create-pdf.pl:                                                                     flagsrequired   => { tools => 'label_creator' },
patroncards/edit-batch.pl:        flagsrequired   => { catalogue => 1 },
patroncards/edit-layout.pl:        flagsrequired   => { catalogue => 1 },
patroncards/edit-profile.pl:        flagsrequired   => { catalogue => 1 },
patroncards/edit-template.pl:        flagsrequired   => { catalogue => 1 },
patroncards/home.pl:        flagsrequired   => { catalogue => 1 },
patroncards/image-manage.pl:                    flagsrequired       => {tools => 'batch_upload_patron_images'}, # FIXME: establish flag for patron card creator
patroncards/manage.pl:        flagsrequired   => { catalogue => 1 },
patroncards/print.pl:        flagsrequired   => { catalogue => 1 },

Should they all use tools => batch_upload_patron_images?
Comment 2 Katrin Fischer 2021-02-18 22:44:25 UTC 
Hm, I believe label_creator would probably make more sense here. And the manage image is, I think, not only about patron images, but could be general ones too.
Comment 3 Martin Renvoize (ashimema) 2021-02-19 09:24:10 UTC 
Yes, I think I agree Katrin.. sorry for the slow reply.. was still wrapping my brain around what permission was most suitable.
Comment 4 Martin Renvoize (ashimema) 2021-02-19 10:17:26 UTC 
Created attachment 117059 [details] [review]
Bug 27716: Update permissions for patroncards creator

The various subpages of the label creator tool we're under the
'catalogue' permission. There is however a 'label_creator' subpermission
of tools which is more appropriate.

Test plan
1/ Setup a user with just the 'catelogue' permission (to enable logging
into the staff interface)
2/ With the patch applied you should not be able to access the following
pages (either via navigation in the UI or by typing them into the
browser address bar directly)
  - /patroncards/add_user_search.pl
  - /patroncards/edit-batch.pl
  - /patroncards/edit-layout.pl
  - /patroncards/edit-profile.pl
  - /patroncards/edit-template.pl
  - /patroncards/home.pl
  - /patroncards/image-manage.pl
  - /patroncards/manage.pl
  - /patroncards/print.pl
3/ Signoff
Comment 5 Owen Leonard 2021-02-23 11:55:26 UTC 
Created attachment 117197 [details] [review]
Bug 27716: Update permissions for patroncards creator

The various subpages of the label creator tool we're under the
'catalogue' permission. There is however a 'label_creator' subpermission
of tools which is more appropriate.

Test plan
1/ Setup a user with just the 'catelogue' permission (to enable logging
into the staff interface)
2/ With the patch applied you should not be able to access the following
pages (either via navigation in the UI or by typing them into the
browser address bar directly)
  - /patroncards/add_user_search.pl
  - /patroncards/edit-batch.pl
  - /patroncards/edit-layout.pl
  - /patroncards/edit-profile.pl
  - /patroncards/edit-template.pl
  - /patroncards/home.pl
  - /patroncards/image-manage.pl
  - /patroncards/manage.pl
  - /patroncards/print.pl
3/ Signoff

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 6 Katrin Fischer 2021-03-04 16:01:57 UTC 
Created attachment 117742 [details] [review]
Bug 27716: Update permissions for patroncards creator

The various subpages of the label creator tool we're under the
'catalogue' permission. There is however a 'label_creator' subpermission
of tools which is more appropriate.

Test plan
1/ Setup a user with just the 'catelogue' permission (to enable logging
into the staff interface)
2/ With the patch applied you should not be able to access the following
pages (either via navigation in the UI or by typing them into the
browser address bar directly)
  - /patroncards/add_user_search.pl
  - /patroncards/edit-batch.pl
  - /patroncards/edit-layout.pl
  - /patroncards/edit-profile.pl
  - /patroncards/edit-template.pl
  - /patroncards/home.pl
  - /patroncards/image-manage.pl
  - /patroncards/manage.pl
  - /patroncards/print.pl
3/ Signoff

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 7 Katrin Fischer 2021-03-04 16:03:26 UTC 
Created attachment 117743 [details] [review]
Bug 27716: Update permissions for patroncards creator

The various subpages of the label creator tool we're under the
'catalogue' permission. There is however a 'label_creator' subpermission
of tools which is more appropriate.

Test plan
1/ Setup a user with just the 'catelogue' permission (to enable logging
into the staff interface)
2/ With the patch applied you should not be able to access the following
pages (either via navigation in the UI or by typing them into the
browser address bar directly)
  - /patroncards/add_user_search.pl
  - /patroncards/edit-batch.pl
  - /patroncards/edit-layout.pl
  - /patroncards/edit-profile.pl
  - /patroncards/edit-template.pl
  - /patroncards/home.pl
  - /patroncards/image-manage.pl
  - /patroncards/manage.pl
  - /patroncards/print.pl
3/ Signoff

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 11 Jonathan Druart 2021-03-16 15:11:01 UTC 
Pushed to master for 21.05, thanks to everybody involved!
Comment 12 Andrew Fuerste-Henry 2021-03-23 18:48:24 UTC 
I'm not anxious to change permissions outside of a full version upgrade. Not backporting to 20.05, but feel free to ask if needed.
Comment 13 Martin Renvoize (ashimema) 2021-03-24 09:55:09 UTC 
Was this still getting considered for 20.11?
Comment 14 Fridolin Somers 2021-03-24 11:20:29 UTC 
Pushed to 20.11.x for 20.11.04
Comment 15 Fridolin Somers 2021-03-24 11:21:06 UTC 
20.11 is still young so I think permission change is not a problem.

I understand it is different of older versions.