Bug 36532 - Any authenticated OPAC user can run opac-dismiss-message.pl for any user/any message
Summary: Any authenticated OPAC user can run opac-dismiss-message.pl for any user/any ...
Status: Pushed to oldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal (vote)
Assignee: Jonathan Druart
QA Contact: David Cook
URL:
Keywords:
Depends on: 12029
Blocks:
  Show dependency treegraph
 
Reported: 2024-04-05 05:44 UTC by David Cook
Modified: 2024-05-22 13:26 UTC (History)
14 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00,23.11.05,23.05.11


Attachments
Bug 36532: Protect opac-dismiss-message.pl from malicious usages (2.25 KB, patch)
2024-04-05 06:59 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 36532: Protect opac-dismiss-message.pl from malicious usages (2.29 KB, patch)
2024-04-05 14:43 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 36532: Protect opac-dismiss-message.pl from malicious usages (2.35 KB, patch)
2024-04-09 06:46 UTC, David Cook
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2024-04-05 05:44:02 UTC
If you're an authenticated OPAC user, you can craft requests to opac-dismiss-message.pl to update the "patron_read_date" for any message for any user. 

Note this won't work for an anonymous/unauthenticated user.
Comment 2 Jonathan Druart 2024-04-05 06:59:00 UTC
Created attachment 164450 [details] [review]
Bug 36532: Protect opac-dismiss-message.pl from malicious usages

Really bad design, NEVER retrieve the logged in user from the CGI param!

See comment 1 for more info
Comment 3 Owen Leonard 2024-04-05 14:43:18 UTC
Created attachment 164484 [details] [review]
Bug 36532: Protect opac-dismiss-message.pl from malicious usages

Really bad design, NEVER retrieve the logged in user from the CGI
param!

See comment 1 for more info

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 4 David Cook 2024-04-09 06:46:16 UTC
Created attachment 164526 [details] [review]
Bug 36532: Protect opac-dismiss-message.pl from malicious usages

Really bad design, NEVER retrieve the logged in user from the CGI
param!

See comment 1 for more info

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 5 David Cook 2024-04-09 06:46:38 UTC
Great job, Jonathan. Thanks for taking care of this one.
Comment 6 wainuiwitikapark 2024-04-24 01:46:24 UTC
Applied to 22.05.x-security
Comment 7 wainuiwitikapark 2024-05-02 04:38:11 UTC
I am getting the following error on jenkins:

"xt_find_cud_t.This branch is not supposed to have 'cud-', see bug 34478. (2034)"

https://jenkins.koha-community.org/job/Koha_Sec/job/Koha_22.05/lastCompletedBuild/testReport/(root)/xt_find_cud_t/This_branch_is_not_supposed_to_have__cud____see_bug_34478___2034_/

I ran the prove xt/find-cud.t and got the following output:

kohadev-koha@kohadevbox:koha((9733fdbbcbf...))$ prove xt/find-cud.t 
xt/find-cud.t .. 1/1 
#   Failed test 'This branch is not supposed to have 'cud-', see bug 34478.'
#   at xt/find-cud.t line 25.
#          got: '2'
#     expected: '0'
# $VAR1 = [
#           'koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc:                    <input type="hidden" name="op" value="cud-update" />',
#           'opac/opac-routing-lists.pl:unless ( $op =~ /^cud-/ && $message ) {'
#         ];
# Looks like you failed 1 test of 1.
xt/find-cud.t .. Dubious, test returned 1 (wstat 256, 0x100)
Failed 1/1 subtests 

Test Summary Report
-------------------
xt/find-cud.t (Wstat: 256 (exited 1) Tests: 1 Failed: 1)
  Failed test:  1
  Non-zero exit status: 1
Files=1, Tests=1,  0 wallclock secs ( 0.01 usr  0.01 sys +  0.09 cusr  0.20 csys =  0.31 CPU)
Result: FAIL

Which says there is something wrong with the following files 
- koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc
- opac/opac-routing-lists.pl

And those files were changed in this bug - and have added "cud-"

Is there a way that I can fix this failing test?
Comment 8 wainuiwitikapark 2024-05-02 04:47:11 UTC
Oh I am also getting the following error which also seems to be related to this bug https://jenkins.koha-community.org/job/Koha_Sec/job/Koha_22.05/lastCompletedBuild/testReport/(root)/t_db_dependent_00_strict_t/Syntax_check_opac_opac_routing_lists_pl__1798_/

Please help :)
Comment 9 Nick Clemens (kidclamp) 2024-05-02 13:39:05 UTC
(In reply to wainuiwitikapark from comment #8)
> Oh I am also getting the following error which also seems to be related to
> this bug
> https://jenkins.koha-community.org/job/Koha_Sec/job/Koha_22.05/
> lastCompletedBuild/testReport/(root)/t_db_dependent_00_strict_t/
> Syntax_check_opac_opac_routing_lists_pl__1798_/
> 
> Please help :)

I think you can just revert as the base feature doesn't exist in 22.05
Comment 10 wainuiwitikapark 2024-05-03 02:34:12 UTC
This doesn't apply because the dependency https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12029 isn't in 22.05
Comment 11 wainuiwitikapark 2024-05-03 02:34:33 UTC
(In reply to wainuiwitikapark from comment #6)
> Applied to 22.05.x-security

Reverted this out of 22.05
Comment 12 Tomás Cohen Arazi 2024-05-15 20:49:20 UTC
Pushed for 24.05!

Well done everyone, thank you!
Comment 13 Fridolin Somers 2024-05-22 13:13:33 UTC
Arg, I see it is in 22.11.x but depends on Bug 12029 only since 23.05

https://git.koha-community.org/Koha-community/Koha/commit/2278d229e899cd279f62addd8275365718ad8cbb
Comment 14 Fridolin Somers 2024-05-22 13:26:33 UTC
I've done a message to @fredericdemians in chat