Another bad one http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create Fill the form, submit, cry
This sounds very bad too.
Created attachment 124451 [details] [review] Bug 28947: Prevent OPAC user to create new users
BibLibre team found this!
Test self-reg(with and without PatronSelfRegistration+ with and without PatronSelfRegistrationVerifyByEmail) + self-mod.
Created attachment 124452 [details] [review] Bug 28947: Prevent OPAC user to create new users This patch prevents an existing user from exploiting the patron edit form in order to force create new patrons To test: 1 - Test with PatronSelfRegistration:Don't Allow PatronSelfRegistrationVerifyByEmail:Don't Require - sign in to opac - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - Fill out form - patron is created FAIL - sign out - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - you are sent to opac-main 2 - Test with PatronSelfRegistration:Don't Allow PatronSelfRegistrationVerifyByEmail:Require - sign in to opac - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - Fill out form - patron is sent email/will be created FAIL - sign out - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - you are sent to opac-main 3 - Test with PatronSelfRegistration:Allow PatronSelfRegistrationVerifyByEmail:Don't Require - sign in to opac - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - Fill out form - patron is created FAIL - sign out - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - patron is created OK 4 - Test with PatronSelfRegistration:Allow PatronSelfRegistrationVerifyByEmail:Require - sign in to opac - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - Fill out form - patron is sent email/will be created FAIL - sign out - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - patron is sent email/will be created OK 5 - APPLY PATCH 6 - Test with PatronSelfRegistration:Don't Allow PatronSelfRegistrationVerifyByEmail:Don't Require - sign in to opac - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - You are sent to opac-main - sign out - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - You are sent to opac-main 7 - Test with PatronSelfRegistration:Don't Allow PatronSelfRegistrationVerifyByEmail:Require - sign in to opac - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - You are sent to opac-main - sign out - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - You are sent to opac-main 8 - Test with PatronSelfRegistration:Allow PatronSelfRegistrationVerifyByEmail:Don't Require - sign in to opac - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - You are sent to opac-main - sign out - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - patron is created OK 9 - Test with PatronSelfRegistration:Allow PatronSelfRegistrationVerifyByEmail:Require - sign in to opac - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - You are sent to opac-main - sign out - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - patron is sent email/will be created OK Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Should the exploitation instructions be in the commit message in this case? Just unsure about releasing instructions possibly before people had a fair chance to patch.
(In reply to Katrin Fischer from comment #6) > Should the exploitation instructions be in the commit message in this case? > Just unsure about releasing instructions possibly before people had a fair > chance to patch. Fair point, I just wanted to get them listed. Please remove on QA :-)
QA: Looking here now
Created attachment 124533 [details] [review] Bug 28947: Prevent OPAC user to create new users This patch prevents an existing user from exploiting the patron edit form in order to force create new patrons To test: Try all combinations of PatronSelfRegistration and PatronSelfRegistrationVerifyByEmail with and without this patch. Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
There is confusion about the $action parameter. Someone may have introduced new at some point while it should have been create which is used more widely in the script/template. The script and template contain only a few references to new. Probably better to replace them (on another report)?
Is it just the naming or something wrong with the patch itself you are worried about?
(In reply to Katrin Fischer from comment #11) > Is it just the naming or something wrong with the patch itself you are > worried about? No, this inconsistency is already before the patch. But the patch adds another instance of action=new. Can be fixed elsewhere.
Verified the problem on our 18.11.16 installations and can confirm that the patch has the intended effect. Also tested that with the patch applied address changes and patron self registration when acticated still work as expected.
Backported: Pushed to 20.05.x security branch for 20.05.16 Testing was done with - when logged in the opac - going to http://localhost:8080/cgi-bin/koha/opac-memberentry.pl?action=create - creating a user - using F5 to create another one (to check the the server will actually reject the network request, not just forbid displaying the form) - applying the patch - using F5 and seeing that a 3rd user isn't created
Backported to 21.05.04, 20.11.10, 20.05.16, 19.11.22
Pushed to master for 21.11, thanks to everybody involved!