Bugzilla – Attachment 106982 Details for
Bug 23634
Privilege escalation vulnerability for staff users with 'edit_borrowers' permission and 'OpacResetPassword' enabled
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 23634: Secure the email on the API
Bug-23634-Secure-the-email-on-the-API.patch (text/plain), 3.02 KB, created by
Marcel de Rooy
on 2020-07-17 08:45:01 UTC
(
hide
)
Description:
Bug 23634: Secure the email on the API
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2020-07-17 08:45:01 UTC
Size:
3.02 KB
patch
obsolete
>From aae04207b8dbee409b6f9bdf065734638de01a06 Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Tue, 19 Nov 2019 13:16:16 -0300 >Subject: [PATCH] Bug 23634: Secure the email on the API >Content-Type: text/plain; charset=utf-8 > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > Koha/REST/V1/Patrons.pm | 9 +++++++++ > t/db_dependent/api/v1/patrons.t | 20 ++++++++++++++++++-- > 2 files changed, 27 insertions(+), 2 deletions(-) > >diff --git a/Koha/REST/V1/Patrons.pm b/Koha/REST/V1/Patrons.pm >index 331ced1464..591a170404 100644 >--- a/Koha/REST/V1/Patrons.pm >+++ b/Koha/REST/V1/Patrons.pm >@@ -205,6 +205,15 @@ sub update { > } > > return try { >+ my $body = $c->validation->param('body'); >+ my $user = $c->stash('koha.user'); >+ >+ if ( $patron->is_superlibrarian and !$user->is_superlibrarian ) { >+ return $c->render( >+ status => 403, >+ openapi => { error => "Not enough privileges to change a superlibrarian's email" } >+ ) if $body->{email} ne $patron->email ; >+ } > > $patron->set_from_api($c->validation->param('body'))->store; > $patron->discard_changes; >diff --git a/t/db_dependent/api/v1/patrons.t b/t/db_dependent/api/v1/patrons.t >index 5a76988fae..a70fbc9625 100644 >--- a/t/db_dependent/api/v1/patrons.t >+++ b/t/db_dependent/api/v1/patrons.t >@@ -222,14 +222,14 @@ subtest 'update() tests' => sub { > $schema->storage->txn_rollback; > > subtest 'librarian access tests' => sub { >- plan tests => 22; >+ plan tests => 25; > > $schema->storage->txn_begin; > > my $authorized_patron = $builder->build_object( > { > class => 'Koha::Patrons', >- value => { flags => 2**4 } # borrowers flag = 4 >+ value => { flags => 1 } > } > ); > my $password = 'thePassword123'; >@@ -330,6 +330,22 @@ subtest 'update() tests' => sub { > is(Koha::Patrons->find( $patron_2->id )->cardnumber, > $newpatron->{ cardnumber }, 'Patron is really updated!'); > >+ my $superlibrarian = $builder->build_object( >+ { >+ class => 'Koha::Patrons', >+ value => { flags => 1 } >+ } >+ ); >+ >+ $newpatron->{cardnumber} = $superlibrarian->cardnumber; >+ $newpatron->{userid} = $superlibrarian->userid; >+ $newpatron->{email} = 'nosense@no.no'; >+ >+ $authorized_patron->flags( 2**4 )->store; # borrowers flag = 4 >+ $t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron ) >+ ->status_is(403, "Non-superlibrarian user change of superlibrarian email forbidden") >+ ->json_is( { error => "Not enough privileges to change a superlibrarian's email" } ); >+ > $schema->storage->txn_rollback; > }; > }; >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 23634
:
92932
|
92998
|
95563
|
95564
|
95574
|
95575
|
95576
|
95577
|
95582
|
97986
|
97987
|
97988
|
97989
|
97990
|
106159
|
106160
|
106161
|
106162
|
106163
|
106723
|
106724
|
106725
|
106726
|
106727
|
106764
|
106826
|
106837
|
106838
|
106839
|
106840
|
106841
|
106842
|
106843
|
106844
|
106979
|
106980
|
106981
| 106982 |
106983
|
106984
|
106985
|
106986
|
109582