Bugzilla – Attachment 163420 Details for
Bug 24879
Add missing authentication checks
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 24879: Add check_cookie_auth when missing
Bug-24879-Add-checkcookieauth-when-missing.patch (text/plain), 11.00 KB, created by
Martin Renvoize
on 2024-03-19 11:49:43 UTC
(
hide
)
Description:
Bug 24879: Add check_cookie_auth when missing
Filename:
MIME Type:
Creator:
Martin Renvoize
Created:
2024-03-19 11:49:43 UTC
Size:
11.00 KB
patch
obsolete
>From 15530e61d5e959ec2f20d9a7df8140d59db89c25 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Thu, 14 Mar 2024 16:19:06 +0100 >Subject: [PATCH] Bug 24879: Add check_cookie_auth when missing > >This can certainly be improved to adjust the permissions, but at least >they are no longer opened to the world.. > >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > acqui/check_uniqueness.pl | 7 +++++++ > catalogue/image.pl | 7 +++++++ > cataloguing/plugin_launcher.pl | 8 ++++++++ > cataloguing/value_builder/barcode.pl | 10 ++++++++++ > cataloguing/value_builder/barcode_manual.pl | 10 ++++++++++ > cataloguing/value_builder/dateaccessioned.pl | 10 ++++++++++ > cataloguing/value_builder/marc21_field_005.pl | 10 ++++++++++ > cataloguing/value_builder/marc21_field_245h.pl | 12 +++++++++++- > cataloguing/value_builder/marc21_field_260b.pl | 10 ++++++++++ > cataloguing/value_builder/marc21_orgcode.pl | 9 +++++++++ > cataloguing/value_builder/stocknumber.pl | 9 +++++++++ > cataloguing/value_builder/upload.pl | 10 ++++++++++ > labels/label-create-csv.pl | 6 ++++++ > labels/label-create-xml.pl | 6 ++++++ > serials/lateissues-export.pl | 7 +++++++ > 15 files changed, 130 insertions(+), 1 deletion(-) > >diff --git a/acqui/check_uniqueness.pl b/acqui/check_uniqueness.pl >index b665b34c3a4..791814095f7 100755 >--- a/acqui/check_uniqueness.pl >+++ b/acqui/check_uniqueness.pl >@@ -37,6 +37,13 @@ use C4::Output qw( output_with_http_headers ); > use C4::Items qw( SearchItems ); > > my $input = CGI->new; >+my ($auth_status) = >+ check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+if ( $auth_status ne "ok" ) { >+ print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); >+ exit 0; >+} >+ > my @field = $input->multi_param('field[]'); > my @value = $input->multi_param('value[]'); > >diff --git a/catalogue/image.pl b/catalogue/image.pl >index 41eebc019c8..efdcae49370 100755 >--- a/catalogue/image.pl >+++ b/catalogue/image.pl >@@ -33,6 +33,13 @@ use Koha::CoverImages; > $| = 1; > > my $input = CGI->new; >+my ($auth_status) = >+ check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+if ( $auth_status ne "ok" ) { >+ print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); >+ exit 0; >+} >+ > my $imagenumber; > > =head1 NAME >diff --git a/cataloguing/plugin_launcher.pl b/cataloguing/plugin_launcher.pl >index 90105f326cd..b31ca52c893 100755 >--- a/cataloguing/plugin_launcher.pl >+++ b/cataloguing/plugin_launcher.pl >@@ -19,10 +19,18 @@ > > use Modern::Perl; > use CGI qw ( -utf8 ); >+use C4::Auth qw( check_cookie_auth ); > > use Koha::FrameworkPlugin; > > my $input = CGI->new; >+my ($auth_status) = >+ check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+if ( $auth_status ne "ok" ) { >+ print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); >+ exit 0; >+} >+ > my $plugin= Koha::FrameworkPlugin->new( { > name => scalar $input->param("plugin_name"), > }); >diff --git a/cataloguing/value_builder/barcode.pl b/cataloguing/value_builder/barcode.pl >index b166b46c4d5..5ec7dbece4b 100755 >--- a/cataloguing/value_builder/barcode.pl >+++ b/cataloguing/value_builder/barcode.pl >@@ -29,6 +29,16 @@ use Koha::DateUtils qw( dt_from_string ); > > use Algorithm::CheckDigits qw( CheckDigits ); > >+use CGI qw ( -utf8 ); >+use C4::Auth qw( check_cookie_auth ); >+my $input = CGI->new; >+my ($auth_status) = >+ check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+if ( $auth_status ne "ok" ) { >+ print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); >+ exit 0; >+} >+ > my $builder = sub { > my ( $params ) = @_; > my $function_name = $params->{id}; >diff --git a/cataloguing/value_builder/barcode_manual.pl b/cataloguing/value_builder/barcode_manual.pl >index a7d015ba7ac..67891789e31 100755 >--- a/cataloguing/value_builder/barcode_manual.pl >+++ b/cataloguing/value_builder/barcode_manual.pl >@@ -27,6 +27,16 @@ use C4::Barcodes::ValueBuilder; > use C4::Biblio qw( GetMarcFromKohaField ); > use Koha::DateUtils qw( dt_from_string ); > >+use CGI qw ( -utf8 ); >+use C4::Auth qw( check_cookie_auth ); >+my $input = CGI->new; >+my ($auth_status) = >+ check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+if ( $auth_status ne "ok" ) { >+ print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); >+ exit 0; >+} >+ > my $builder = sub { > my ( $params ) = @_; > my $function_name = $params->{id}; >diff --git a/cataloguing/value_builder/dateaccessioned.pl b/cataloguing/value_builder/dateaccessioned.pl >index 808fc80116b..c4f7746b7ff 100755 >--- a/cataloguing/value_builder/dateaccessioned.pl >+++ b/cataloguing/value_builder/dateaccessioned.pl >@@ -21,6 +21,16 @@ > # along with Koha; if not, see <http://www.gnu.org/licenses>. > > use Modern::Perl; >+use CGI qw ( -utf8 ); >+use C4::Auth qw( check_cookie_auth ); >+my $input = CGI->new; >+my ($auth_status) = >+ check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+if ( $auth_status ne "ok" ) { >+ print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); >+ exit 0; >+} >+ > my $builder = sub { > my ( $params ) = @_; > my $function_name = $params->{id}; >diff --git a/cataloguing/value_builder/marc21_field_005.pl b/cataloguing/value_builder/marc21_field_005.pl >index 545a1a4f917..6428bd61a99 100755 >--- a/cataloguing/value_builder/marc21_field_005.pl >+++ b/cataloguing/value_builder/marc21_field_005.pl >@@ -21,6 +21,16 @@ > > use Modern::Perl; > >+use CGI qw ( -utf8 ); >+use C4::Auth qw( check_cookie_auth ); >+my $input = CGI->new; >+my ($auth_status) = >+ check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+if ( $auth_status ne "ok" ) { >+ print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); >+ exit 0; >+} >+ > my $builder = sub { > my ( $params ) = @_; > my $function_name = $params->{id}; >diff --git a/cataloguing/value_builder/marc21_field_245h.pl b/cataloguing/value_builder/marc21_field_245h.pl >index 667ae2249ac..4fe4a2f1e75 100755 >--- a/cataloguing/value_builder/marc21_field_245h.pl >+++ b/cataloguing/value_builder/marc21_field_245h.pl >@@ -20,7 +20,17 @@ > # along with Koha; if not, see <http://www.gnu.org/licenses>. > > use Modern::Perl; >-use C4::Context; >+ >+use CGI qw ( -utf8 ); >+use C4::Auth qw( check_cookie_auth ); >+my $input = CGI->new; >+my ($auth_status) = >+ check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+if ( $auth_status ne "ok" ) { >+ print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); >+ exit 0; >+} >+ > > my $builder = sub { > my ( $params ) = @_; >diff --git a/cataloguing/value_builder/marc21_field_260b.pl b/cataloguing/value_builder/marc21_field_260b.pl >index 406feb41221..e9a74a07ba4 100755 >--- a/cataloguing/value_builder/marc21_field_260b.pl >+++ b/cataloguing/value_builder/marc21_field_260b.pl >@@ -27,6 +27,16 @@ biblioitems.publishercode > use Modern::Perl; > use C4::Context; > >+use CGI qw ( -utf8 ); >+use C4::Auth qw( check_cookie_auth ); >+my $input = CGI->new; >+my ($auth_status) = >+ check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+if ( $auth_status ne "ok" ) { >+ print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); >+ exit 0; >+} >+ > my $builder = sub { > my ( $params ) = @_; > my $function_name = $params->{id}; >diff --git a/cataloguing/value_builder/marc21_orgcode.pl b/cataloguing/value_builder/marc21_orgcode.pl >index aa9142cfc73..0dd985803c9 100755 >--- a/cataloguing/value_builder/marc21_orgcode.pl >+++ b/cataloguing/value_builder/marc21_orgcode.pl >@@ -24,6 +24,15 @@ use Modern::Perl; > use C4::Context; > > use Koha::Libraries; >+use CGI qw ( -utf8 ); >+use C4::Auth qw( check_cookie_auth ); >+my $input = CGI->new; >+my ($auth_status) = >+ check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+if ( $auth_status ne "ok" ) { >+ print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); >+ exit 0; >+} > > my $builder = sub { > my ( $params ) = @_; >diff --git a/cataloguing/value_builder/stocknumber.pl b/cataloguing/value_builder/stocknumber.pl >index 51d7a1986c3..61885d12b05 100755 >--- a/cataloguing/value_builder/stocknumber.pl >+++ b/cataloguing/value_builder/stocknumber.pl >@@ -21,6 +21,15 @@ > > use Modern::Perl; > use C4::Context; >+use CGI qw ( -utf8 ); >+use C4::Auth qw( check_cookie_auth ); >+my $input = CGI->new; >+my ($auth_status) = >+ check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+if ( $auth_status ne "ok" ) { >+ print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); >+ exit 0; >+} > > my $builder = sub { > my ( $params ) = @_; >diff --git a/cataloguing/value_builder/upload.pl b/cataloguing/value_builder/upload.pl >index 82b9816f625..eeb422d5258 100755 >--- a/cataloguing/value_builder/upload.pl >+++ b/cataloguing/value_builder/upload.pl >@@ -30,6 +30,16 @@ use Modern::Perl; > # the possibility to delete the uploaded file. If the field is empty, you > # can upload a new file. > >+use CGI qw ( -utf8 ); >+use C4::Auth qw( check_cookie_auth ); >+my $input = CGI->new; >+my ($auth_status) = >+ check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => 1 } ); >+if ( $auth_status ne "ok" ) { >+ print $input->header( -type => 'text/plain', -status => '403 Forbidden' ); >+ exit 0; >+} >+ > my $builder = sub { > my ( $params ) = @_; > return <<"SCRIPT"; >diff --git a/labels/label-create-csv.pl b/labels/label-create-csv.pl >index 8c06a41a0b5..80c662e85a8 100755 >--- a/labels/label-create-csv.pl >+++ b/labels/label-create-csv.pl >@@ -26,6 +26,12 @@ use Text::CSV_XS; > use C4::Labels; > > my $cgi = CGI->new; >+my ($auth_status) = >+ check_cookie_auth( $cgi->cookie('CGISESSID'), { catalogue => 1 } ); >+if ( $auth_status ne "ok" ) { >+ print $cgi->header( -type => 'text/plain', -status => '403 Forbidden' ); >+ exit 0; >+} > > my $batch_id; > my @label_ids; >diff --git a/labels/label-create-xml.pl b/labels/label-create-xml.pl >index 3962cfb5022..a3bec34ec07 100755 >--- a/labels/label-create-xml.pl >+++ b/labels/label-create-xml.pl >@@ -26,6 +26,12 @@ use XML::Simple; > use C4::Labels; > > my $cgi = CGI->new; >+my ($auth_status) = >+ check_cookie_auth( $cgi->cookie('CGISESSID'), { catalogue => 1 } ); >+if ( $auth_status ne "ok" ) { >+ print $cgi->header( -type => 'text/plain', -status => '403 Forbidden' ); >+ exit 0; >+} > > my $batch_id; > my @label_ids; >diff --git a/serials/lateissues-export.pl b/serials/lateissues-export.pl >index af83f2c6f64..f82b9f1e187 100755 >--- a/serials/lateissues-export.pl >+++ b/serials/lateissues-export.pl >@@ -27,6 +27,13 @@ use Koha::CsvProfiles; > use Text::CSV_XS; > > my $query = CGI->new; >+my ($auth_status) = >+ check_cookie_auth( $query->cookie('CGISESSID'), { catalogue => 1 } ); >+if ( $auth_status ne "ok" ) { >+ print $query->header( -type => 'text/plain', -status => '403 Forbidden' ); >+ exit 0; >+} >+ > my $supplierid = $query->param('supplierid'); > my @serialids = $query->multi_param('serialid'); > my $op = $query->param('op') || q{}; >-- >2.44.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 24879
:
100885
|
106978
|
163139
|
163140
|
163141
|
163142
|
163143
|
163183
|
163417
|
163418
|
163419
| 163420 |
163421
|
163422
|
163977