Attachment 123782 Details for Bug 28759 – Bug 28759: limit accessibility for "Manage API keys"

[patch] Bug 28759: limit accessibility for "Manage API keys"

Bug-28759-limit-accessibility-for-Manage-API-keys.patch (text/plain), 3.08 KB, created by Tomás Cohen Arazi (tcohen) on 2021-08-11 11:40:58 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomás Cohen Arazi (tcohen)

Created: 2021-08-11 11:40:58 UTC

Size: 3.08 KB

patch

obsolete

>From 572327aa58ed7bfd7334ae3b8c4336b7e776c2b9 Mon Sep 17 00:00:00 2001
>From: Petro Vashchuk <stalkernoid@gmail.com>
>Date: Tue, 10 Aug 2021 18:08:53 +0300
>Subject: [PATCH] Bug 28759: limit accessibility for "Manage API keys"
>
>This patch limits the accessibility for "Manage API keys" section only
>to superlibrarians and the owner of that said API key account.
>
>The way it does it is by checking if user is superlibrarian or if
>logged-in user is the same as a patron id/borrower number is the same
>as logged-in user number both in template and apikeys.pl and making sure
>the link is inaccessible or redirects to the 403 page if user tries to
>go there directly.
>
>To reproduce:
>1) create/pick existing patron, set Staff access, allows viewing
>of catalogue in staff interface (catalogue)" and "Add, modify and
>iew patron information (borrowers)" permissions on;
>2) enable "RESTOAuth2ClientCredentials" in sysprefs;
>3) login with that user into staff interface;
>4) check any other patron, go to the "More"->"Manage API keys" and
>check that you can see, add delete their API keys;
>5) apply patch;
>6) with that same user try to access "Manage API keys" page again.
>Ensure that you can't access that page of other patrons but can
>access your own page and manage your own API keys.
>7) log in with superlibrarian now and ensure that you can access every
>"Manage API keys" page of every patron and apply changes there.
>
>Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
>---
> .../intranet-tmpl/prog/en/includes/members-toolbar.inc      | 2 +-
> members/apikeys.pl                                          | 6 ++++++
> 2 files changed, 7 insertions(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
>index 44d6f800a6..6b0d8c12ac 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
>@@ -57,7 +57,7 @@
>                 [% END %]
> 
>                 [% IF Koha.Preference('RESTOAuth2ClientCredentials') %]
>-                    [% IF CAN_user_borrowers_edit_borrowers %]
>+                    [% IF CAN_user_superlibrarian OR loggedinusernumber == patron.borrowernumber %]
>                         <li><a id="apikeys" href="/cgi-bin/koha/members/apikeys.pl?patron_id=[% patron.borrowernumber | html %]">Manage API keys</a></li>
>                     [% ELSE %]
>                         <li class="disabled"><a data-toggle="tooltip" data-placement="left" title="You are not authorized to manage API keys" id="apikeys" href="#">Manage API keys</a></li>
>diff --git a/members/apikeys.pl b/members/apikeys.pl
>index f6fde368e4..7d28b1cb32 100755
>--- a/members/apikeys.pl
>+++ b/members/apikeys.pl
>@@ -52,6 +52,12 @@ if ( not defined $patron or
>     exit;
> }
> 
>+if( $patron_id != $loggedinuser && !C4::Context->IsSuperLibrarian() ) {
>+    # not the owner of the account viewing/editing own API keys, nor superlibrarian -> exit
>+    print $cgi->redirect("/cgi-bin/koha/errors/403.pl"); # escape early
>+    exit;
>+}
>+
> my $op = $cgi->param('op') // '';
> 
> if ( $op eq 'generate' or
>-- 
>2.32.0

Actions: View | Diff | Splinter Review

Attachments on bug 28759: 123701 | 123782 | 124494