Bugzilla – Attachment 131483 Details for
Bug 29931
Script plugins-enable.pl should check the cookie status before running plugins
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29931: [21.05.x] Check cookie status before continuing
Bug-29931-2105x-Check-cookie-status-before-continu.patch (text/plain), 4.13 KB, created by
Marcel de Rooy
on 2022-03-08 14:42:52 UTC
(
hide
)
Description:
Bug 29931: [21.05.x] Check cookie status before continuing
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2022-03-08 14:42:52 UTC
Size:
4.13 KB
patch
obsolete
>From ae93184bc479090c5f400afd1767d32c09ff1b63 Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Mon, 24 Jan 2022 10:24:08 +0000 >Subject: [PATCH] Bug 29931: [21.05.x] Check cookie status before continuing >Content-Type: text/plain; charset=utf-8 > >Test plan: >Logout from staff. >Try to run plugins-enable (you should have some active plugin). >Like: https://yourserver:staffport/cgi-bin/koha/plugins/plugins-enable.pl?class=Koha::Plugin::Test&method=enable >Replace class and method as appropriate. >Verify that with this patch, you will be redirected to 401 page. > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> > >Bug 29931: (follow-up) Similar thing in opac-patron-image.pl > >Although less harmful indeed. No borrowernumber, no image. > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Tested: logged in, logged out, prefs toggled. All fine. > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> > >Bug 29931: (follow-up) Fix svc/checkouts and return_claims too > >Adding the same auth_status check here too. > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >--- > opac/opac-patron-image.pl | 13 +++++++------ > plugins/plugins-enable.pl | 7 +++++-- > svc/checkouts | 7 +++++-- > svc/return_claims | 7 +++++-- > 4 files changed, 22 insertions(+), 12 deletions(-) > >diff --git a/opac/opac-patron-image.pl b/opac/opac-patron-image.pl >index b40788db7e..c4358327da 100755 >--- a/opac/opac-patron-image.pl >+++ b/opac/opac-patron-image.pl >@@ -32,13 +32,14 @@ unless (C4::Context->preference('OPACpatronimages')) { > exit; > } > >-my $needed_flags; >-my %cookies = CGI::Cookie->fetch; >-my $sessid = $cookies{'CGISESSID'}->value; >-my ($auth_status, $auth_sessid) = check_cookie_auth($sessid, $needed_flags); >-my $borrowernumber = C4::Context->userenv->{'number'}; >+my ($auth_status) = check_cookie_auth( $query->cookie('CGISESSID') ); >+if( $auth_status ne 'ok' ) { >+ print CGI::header( '-status' => '401' ); >+ exit 0; >+} > >-my $patron_image = Koha::Patron::Images->find($borrowernumber); >+my $userenv = C4::Context->userenv; >+my $patron_image = $userenv ? Koha::Patron::Images->find( $userenv->{number} ) : undef; > > if ($patron_image) { > print $query->header( >diff --git a/plugins/plugins-enable.pl b/plugins/plugins-enable.pl >index 181550781a..bfaaa41778 100755 >--- a/plugins/plugins-enable.pl >+++ b/plugins/plugins-enable.pl >@@ -27,8 +27,11 @@ die("Koha plugins are disabled!") unless C4::Context->config("enable_plugins"); > > my $input = CGI->new; > >-my ( $auth_status, $sessionID ) = >- check_cookie_auth( $input->cookie('CGISESSID'), { plugins => 'manage' } ); >+my ( $auth_status ) = check_cookie_auth( $input->cookie('CGISESSID'), { plugins => 'manage' } ); >+if( $auth_status ne 'ok' ) { >+ print CGI::header( '-status' => '401' ); >+ exit 0; >+} > > my $class = $input->param('class'); > my $method = $input->param('method'); >diff --git a/svc/checkouts b/svc/checkouts >index 38c0017e2c..ab41bc1538 100755 >--- a/svc/checkouts >+++ b/svc/checkouts >@@ -33,8 +33,11 @@ use Koha::ItemTypes; > > my $input = CGI->new; > >-my ( $auth_status, $sessionID ) = >- check_cookie_auth( $input->cookie('CGISESSID')); >+my ( $auth_status, $sessionID ) = check_cookie_auth( $input->cookie('CGISESSID')); >+if( $auth_status ne 'ok' ) { >+ print CGI::header( '-status' => '401' ); >+ exit 0; >+} > > my $session = get_session($sessionID); > my $userid = $session->param('id'); >diff --git a/svc/return_claims b/svc/return_claims >index 2a616f08e2..878f9a6cfa 100755 >--- a/svc/return_claims >+++ b/svc/return_claims >@@ -31,8 +31,11 @@ use Koha::Patrons; > > my $input = CGI->new; > >-my ( $auth_status, $sessionID ) = >- check_cookie_auth( $input->cookie('CGISESSID') ); >+my ( $auth_status, $sessionID ) = check_cookie_auth( $input->cookie('CGISESSID') ); >+if( $auth_status ne 'ok' ) { >+ print CGI::header( '-status' => '401' ); >+ exit 0; >+} > > my $session = get_session($sessionID); > my $userid = $session->param('id'); >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29931
:
129717
|
129721
|
129722
|
129746
|
129747
|
129840
|
129841
|
129842
|
129843
|
129844
|
129845
| 131483