Bugzilla – Attachment 10548 Details for
Bug 3280
opac/opac-sendbasket.pl security leaky
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Signed patch for 3280
patch.txt (text/plain), 3.17 KB, created by
Marcel de Rooy
on 2012-06-28 09:42:30 UTC
(
hide
)
Description:
Signed patch for 3280
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2012-06-28 09:42:30 UTC
Size:
3.17 KB
patch
obsolete
>From 1152b801e393bc7b5cd0c33189ec09db15a668b8 Mon Sep 17 00:00:00 2001 >From: =?UTF-8?q?Fr=C3=A8re=20S=C3=A9bastien=20Marie?= > <semarie-koha@latrappe.fr> >Date: Mon, 5 Dec 2011 10:11:46 +0100 >Subject: [PATCH] Bug 3280 Restrict Send basket feature >Content-Type: text/plain; charset="utf-8" > >In order to prevent spamming using sendbasket.pl, some counter-measure are done: > - permit send basket only for authenticated user > - permit send basket only if basket contains items > - use username & email for 'Reply-To' field (with fallback to KohaAdminEmailAddress) > - add field X-Orig-IP with IP of sender > - add field X-Abuse-Report with KohaAdminEmailAddress > >Note: with don't use forged 'To' address with patron email in order to >prevent be marked as spam (by SPF for example). > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > opac/opac-sendbasket.pl | 23 +++++++++++++++-------- > 1 files changed, 15 insertions(+), 8 deletions(-) > >diff --git a/opac/opac-sendbasket.pl b/opac/opac-sendbasket.pl >index 7787217..9b2484d 100755 >--- a/opac/opac-sendbasket.pl >+++ b/opac/opac-sendbasket.pl >@@ -54,11 +54,19 @@ my $email_sender = $query->param('email_sender'); > my $dbh = C4::Context->dbh; > > if ( $email_add ) { >+ my $user = GetMember(borrowernumber => $borrowernumber); >+ my $user_email = GetFirstValidEmailAddress($borrowernumber) >+ || C4::Context->preference('KohaAdminEmailAddress'); >+ > my $email_from = C4::Context->preference('KohaAdminEmailAddress'); >+ my $email_replyto = "$user->{firstname} $user->{surname} <$user_email>"; > my $comment = $query->param('comment'); > my %mail = ( > To => $email_add, >- From => $email_from >+ From => $email_from, >+ 'Reply-To' => $email_replyto, >+ 'X-Orig-IP' => $ENV{'REMOTE_ADDR'}, >+ 'X-Abuse-Report' => C4::Context->preference('KohaAdminEmailAddress'), > ); > > my ( $template2, $borrowernumber, $cookie ) = get_template_and_user( >@@ -66,7 +74,7 @@ if ( $email_add ) { > template_name => "opac-sendbasket.tmpl", > query => $query, > type => "opac", >- authnotrequired => 1, >+ authnotrequired => 0, > flagsrequired => { borrow => 1 }, > } > ); >@@ -106,8 +114,6 @@ if ( $email_add ) { > > my $resultsarray = \@results; > >- my $user = GetMember(borrowernumber => $borrowernumber); >- > $template2->param( > BIBLIO_RESULTS => $resultsarray, > email_sender => $email_sender, >@@ -162,14 +168,15 @@ $isofile > $boundary-- > END_OF_BODY > >- # Sending mail >- if ( sendmail %mail ) { >- # do something if it works.... >+ # Sending mail (if not empty basket) >+ if ( defined($iso2709) && sendmail %mail ) { >+ # do something if it works.... > $template->param( SENT => "1" ); > } > else { > # do something if it doesnt work.... >- carp "Error sending mail: $Mail::Sendmail::error \n"; >+ carp "Error sending mail: empty basket" if !defined($iso2709); >+ carp "Error sending mail: $Mail::Sendmail::error" if $Mail::Sendmail::error; > $template->param( error => 1 ); > } > $template->param( email_add => $email_add ); >-- >1.7.7.6 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 3280
:
6576
|
10027
|
10547
| 10548 |
10595