Attachment 114695 Details for Bug 21325 – Bug 21325: Prevent authentication when sending userid and password in querystring

[patch] Bug 21325: Prevent authentication when sending userid and password in querystring

Bug-21325-Prevent-authentication-when-sending-user.patch (text/plain), 2.12 KB, created by David Cook on 2020-12-24 01:32:23 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David Cook

Created: 2020-12-24 01:32:23 UTC

Size: 2.12 KB

patch

obsolete

>From 4bf143046a1176c8eae5e5ed88071f73599522fb Mon Sep 17 00:00:00 2001
>From: David Cook <dcook@prosentient.com.au>
>Date: Thu, 24 Dec 2020 01:24:08 +0000
>Subject: [PATCH] Bug 21325: Prevent authentication when sending userid and
> password in querystring
>
>This patch permits authentication via userid/password only when the
>HTTP method is POST when using C4::Auth::checkauth().
>
>The goal is to stop people from supplying userid and password in querystrings
>in order to log into web pages.
>
>Test plan:
>0. Do not apply patch yet
>1. Open a new browser (ie we don't want any existing CGISESSID cookies
>available - opening a new tab/window isn't enough. It must be a
>new instance or you can clear your cookies)
>2. Go to http://localhost:8080/cgi-bin/koha/opac-reserve.pl?biblionumber=29&userid=koha&password=koha
>3. Note the user has been logged in and is being asked to confirm hold.
>
>4. Apply the patch
>
>5. Go to http://localhost:8080/cgi-bin/koha/opac-reserve.pl?biblionumber=29&userid=koha&password=koha
>6. Note the user is not logged in and the user is presented with a login screen
>---
> C4/Auth.pm | 11 +++++++----
> 1 file changed, 7 insertions(+), 4 deletions(-)
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index d2d7c0f392..b8388355ea 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -1072,10 +1072,13 @@ sub checkauth {
>                 }
>                 else {
>                     my $retuserid;
>-                    ( $return, $cardnumber, $retuserid, $cas_ticket ) =
>-                      checkpw( $dbh, $q_userid, $password, $query, $type );
>-                    $userid = $retuserid if ($retuserid);
>-                    $info{'invalid_username_or_password'} = 1 unless ($return);
>+                    my $request_method = $query->request_method();
>+                    if ($request_method eq 'POST'){
>+                        ( $return, $cardnumber, $retuserid, $cas_ticket ) =
>+                          checkpw( $dbh, $q_userid, $password, $query, $type );
>+                        $userid = $retuserid if ($retuserid);
>+                        $info{'invalid_username_or_password'} = 1 unless ($return);
>+                    }
>                 }
>             }
> 
>-- 
>2.11.0

Actions: View | Diff | Splinter Review

Attachments on bug 21325: 114695 | 114696 | 119600 | 119601 | 119697 | 119698 | 119721