Bug 6641 - Specially crafted URL can allow unauthorized download of MARC files from staff client
Summary: Specially crafted URL can allow unauthorized download of MARC files from staf...
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: 3.6
Hardware: All All
: PATCH-Sent (DO NOT USE) major
Assignee: Paul Poulain
QA Contact: Bugs List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-07-28 15:51 UTC by Liz Rea
Modified: 2012-10-25 23:09 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Bug 6641 -- Specially crafted URL can allow unauthorized download of MARC files from staff client (1.55 KB, patch)
2011-07-28 21:32 UTC, Liz Rea 		Details | Diff | Splinter Review
Bug 6641 -- Specially crafted URL can allow unauthorized download of MARC files from staff client (1.56 KB, patch)
2011-08-01 08:44 UTC, Chris Cormack 		Details | Diff | Splinter Review
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Liz Rea 2011-07-28 15:51:11 UTC 
http://staff.client.url/cgi-bin/koha/catalogue/export.pl?format=utf8&op=export&bib=4224 (as an example) would allow unauthorized users to download MARC files from the staff side of the ILS. It might be possible to DOS the staff client using this.

The same functionality is available from the OPAC, the download functionality should only be available from the staff client when a user is logged in.
Comment 1 Liz Rea 2011-07-28 21:32:26 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2011-08-01 08:44:35 UTC 
Created attachment 4786 [details] [review]
Bug 6641 -- Specially crafted URL can allow unauthorized download of MARC files from staff client

Making sure permissions are checked on download of MARC files from staff client

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Comment 3 Chris Cormack 2011-08-01 09:17:53 UTC 
Security issue, patch pushed please test
Comment 4 Liz Rea 2011-08-04 18:51:11 UTC 
Tested, works!