Bug 27716 - Insufficient access control for printer profiles
Summary: Insufficient access control for printer profiles
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: System Administration (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low minor (vote)
Assignee: Martin Renvoize
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-02-17 11:31 UTC by Martin Renvoize
Modified: 2021-12-13 21:11 UTC (History)
9 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
This change moves the label creator pages, including the printer profiles management, under the 'lable_creator' permission under tools. This gives a more refined access permission for this area of functionality.
Version(s) released in:
21.05.00,20.11.04


Attachments
Bug 27716: Update permissions for patroncards creator (6.16 KB, patch)
2021-02-19 10:17 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 27716: Update permissions for patroncards creator (6.21 KB, patch)
2021-02-23 11:55 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 27716: Update permissions for patroncards creator (6.21 KB, patch)
2021-03-04 16:01 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 27716: Update permissions for patroncards creator (6.27 KB, patch)
2021-03-04 16:03 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize 2021-02-17 11:31:15 UTC
A low privileged staff user (i.e. one with just the 'catalogue' permission to enable logging into the staff client) can access and change/add/delete printer profiles.  This functionality should be behind an escalated privilege.
Comment 1 Jonathan Druart 2021-02-18 10:22:42 UTC
% git grep flagsrequired patroncards                                                                                                                        [11:20:56]
patroncards/add_user_search.pl:        flagsrequired   => { catalogue => 1 },
patroncards/create-pdf.pl:                                                                     flagsrequired   => { tools => 'label_creator' },
patroncards/edit-batch.pl:        flagsrequired   => { catalogue => 1 },
patroncards/edit-layout.pl:        flagsrequired   => { catalogue => 1 },
patroncards/edit-profile.pl:        flagsrequired   => { catalogue => 1 },
patroncards/edit-template.pl:        flagsrequired   => { catalogue => 1 },
patroncards/home.pl:        flagsrequired   => { catalogue => 1 },
patroncards/image-manage.pl:                    flagsrequired       => {tools => 'batch_upload_patron_images'}, # FIXME: establish flag for patron card creator
patroncards/manage.pl:        flagsrequired   => { catalogue => 1 },
patroncards/print.pl:        flagsrequired   => { catalogue => 1 },

Should they all use tools => batch_upload_patron_images?
Comment 2 Katrin Fischer 2021-02-18 22:44:25 UTC
Hm, I believe label_creator would probably make more sense here. And the manage image is, I think, not only about patron images, but could be general ones too.
Comment 3 Martin Renvoize 2021-02-19 09:24:10 UTC
Yes, I think I agree Katrin.. sorry for the slow reply.. was still wrapping my brain around what permission was most suitable.
Comment 4 Martin Renvoize 2021-02-19 10:17:26 UTC
Created attachment 117059 [details] [review]
Bug 27716: Update permissions for patroncards creator

The various subpages of the label creator tool we're under the
'catalogue' permission. There is however a 'label_creator' subpermission
of tools which is more appropriate.

Test plan
1/ Setup a user with just the 'catelogue' permission (to enable logging
into the staff interface)
2/ With the patch applied you should not be able to access the following
pages (either via navigation in the UI or by typing them into the
browser address bar directly)
  - /patroncards/add_user_search.pl
  - /patroncards/edit-batch.pl
  - /patroncards/edit-layout.pl
  - /patroncards/edit-profile.pl
  - /patroncards/edit-template.pl
  - /patroncards/home.pl
  - /patroncards/image-manage.pl
  - /patroncards/manage.pl
  - /patroncards/print.pl
3/ Signoff
Comment 5 Owen Leonard 2021-02-23 11:55:26 UTC
Created attachment 117197 [details] [review]
Bug 27716: Update permissions for patroncards creator

The various subpages of the label creator tool we're under the
'catalogue' permission. There is however a 'label_creator' subpermission
of tools which is more appropriate.

Test plan
1/ Setup a user with just the 'catelogue' permission (to enable logging
into the staff interface)
2/ With the patch applied you should not be able to access the following
pages (either via navigation in the UI or by typing them into the
browser address bar directly)
  - /patroncards/add_user_search.pl
  - /patroncards/edit-batch.pl
  - /patroncards/edit-layout.pl
  - /patroncards/edit-profile.pl
  - /patroncards/edit-template.pl
  - /patroncards/home.pl
  - /patroncards/image-manage.pl
  - /patroncards/manage.pl
  - /patroncards/print.pl
3/ Signoff

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 6 Katrin Fischer 2021-03-04 16:01:57 UTC
Created attachment 117742 [details] [review]
Bug 27716: Update permissions for patroncards creator

The various subpages of the label creator tool we're under the
'catalogue' permission. There is however a 'label_creator' subpermission
of tools which is more appropriate.

Test plan
1/ Setup a user with just the 'catelogue' permission (to enable logging
into the staff interface)
2/ With the patch applied you should not be able to access the following
pages (either via navigation in the UI or by typing them into the
browser address bar directly)
  - /patroncards/add_user_search.pl
  - /patroncards/edit-batch.pl
  - /patroncards/edit-layout.pl
  - /patroncards/edit-profile.pl
  - /patroncards/edit-template.pl
  - /patroncards/home.pl
  - /patroncards/image-manage.pl
  - /patroncards/manage.pl
  - /patroncards/print.pl
3/ Signoff

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 7 Katrin Fischer 2021-03-04 16:03:26 UTC
Created attachment 117743 [details] [review]
Bug 27716: Update permissions for patroncards creator

The various subpages of the label creator tool we're under the
'catalogue' permission. There is however a 'label_creator' subpermission
of tools which is more appropriate.

Test plan
1/ Setup a user with just the 'catelogue' permission (to enable logging
into the staff interface)
2/ With the patch applied you should not be able to access the following
pages (either via navigation in the UI or by typing them into the
browser address bar directly)
  - /patroncards/add_user_search.pl
  - /patroncards/edit-batch.pl
  - /patroncards/edit-layout.pl
  - /patroncards/edit-profile.pl
  - /patroncards/edit-template.pl
  - /patroncards/home.pl
  - /patroncards/image-manage.pl
  - /patroncards/manage.pl
  - /patroncards/print.pl
3/ Signoff

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 11 Jonathan Druart 2021-03-16 15:11:01 UTC
Pushed to master for 21.05, thanks to everybody involved!
Comment 12 Andrew Fuerste-Henry 2021-03-23 18:48:24 UTC
I'm not anxious to change permissions outside of a full version upgrade. Not backporting to 20.05, but feel free to ask if needed.
Comment 13 Martin Renvoize 2021-03-24 09:55:09 UTC
Was this still getting considered for 20.11?
Comment 14 Fridolin Somers 2021-03-24 11:20:29 UTC
Pushed to 20.11.x for 20.11.04
Comment 15 Fridolin Somers 2021-03-24 11:21:06 UTC
20.11 is still young so I think permission change is not a problem.

I understand it is different of older versions.