Bug 6648 - insecure /cgi-bin/koha/ (of staff part) mapping in development mode of installation
Summary: insecure /cgi-bin/koha/ (of staff part) mapping in development mode of instal...
Status: RESOLVED DUPLICATE of bug 9949
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Galen Charlton
QA Contact: Bugs List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-07-29 15:50 UTC by Sébastien Marie
Modified: 2013-04-13 23:25 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sébastien Marie 2011-07-29 15:50:54 UTC
This issue is between security issue and enhancement... the problem occurs only in 'dev' installation of koha (but it is common).

When a installation is done in 'dev' mode, the ScriptAlias in apache for the 'intranet' is the git repository in entire.

In result, any file that could be executed may be launched by any user from http://intranet/cgi-bin/koha/... The file are run without arguments.

The problem is important for scripts like cronjobs, that are generally resource-consuming and run without arguments.

Others scripts that do more evil think may also exist...


As Makefile.PL know with directories (or files) should be acceded, an htacess should be generated for here in order to allow only 'INTRANET_CGI_DIR' and 'INTRANET_TMPL_DIR'.
Comment 1 Chris Cormack 2013-04-13 23:25:02 UTC

*** This bug has been marked as a duplicate of bug 9949 ***