Bugzilla – Attachment 186916 Details for
Bug 39142
Add debug permission to allow user to toggle JS and CSS customizations on/off
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 39142: (QA follow-up) Add permission checking for syspref overrides
Bug-39142-QA-follow-up-Add-permission-checking-for.patch (text/plain), 2.51 KB, created by
Martin Renvoize (ashimema)
on 2025-09-25 10:53:51 UTC
(
hide
)
Description:
Bug 39142: (QA follow-up) Add permission checking for syspref overrides
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2025-09-25 10:53:51 UTC
Size:
2.51 KB
patch
obsolete
>From 2b7a97be88dcbd6342d694d861dc71a0c38b08ff Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@openfifth.co.uk> >Date: Thu, 25 Sep 2025 11:35:11 +0100 >Subject: [PATCH] Bug 39142: (QA follow-up) Add permission checking for syspref > overrides > >This follow-up adds proper security controls for the DISABLE_SYSPREF_* >URL parameter functionality introduced in Bug 14004. Previously, any >user could bypass system preferences by using URL parameters without >authorization. > >Changes: >- Restricts DISABLE_SYSPREF_* parameter processing to users with debug permission >- Uses existing haspermission() method for consistent authorization checking >- Maintains superlibrarian access as expected >- Closes potential security loophole where unauthorized users could disable > system preferences like IntranetUserJS and IntranetUserCSS > >The debug UI buttons will only appear for authorized users, and now the >underlying syspref override functionality requires the same permission, >ensuring both UI and functional security are aligned. > >Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> >--- > C4/Auth.pm | 33 ++++++++++++++++++--------------- > 1 file changed, 18 insertions(+), 15 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 20242735e1a..f329f83b9fc 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -476,21 +476,24 @@ sub get_template_and_user { > > # Sysprefs disabled via URL param > # Note that value must be defined in order to override via ENV >- foreach my $syspref ( >- qw( >- OPACUserCSS >- OPACUserJS >- IntranetUserCSS >- IntranetUserJS >- OpacAdditionalStylesheet >- opaclayoutstylesheet >- intranetcolorstylesheet >- intranetstylesheet >- ) >- ) >- { >- $ENV{"OVERRIDE_SYSPREF_$syspref"} = q{} >- if $in->{'query'}->param("DISABLE_SYSPREF_$syspref"); >+ # Only allow syspref overrides for users with debug permission >+ if ( C4::Context->userenv && haspermission( C4::Context->userenv->{'id'}, { debug => 1 } ) ) { >+ foreach my $syspref ( >+ qw( >+ OPACUserCSS >+ OPACUserJS >+ IntranetUserCSS >+ IntranetUserJS >+ OpacAdditionalStylesheet >+ opaclayoutstylesheet >+ intranetcolorstylesheet >+ intranetstylesheet >+ ) >+ ) >+ { >+ $ENV{"OVERRIDE_SYSPREF_$syspref"} = q{} >+ if $in->{'query'}->param("DISABLE_SYSPREF_$syspref"); >+ } > } > > # Anonymous opac search history >-- >2.51.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 39142
:
178123
|
178294
|
178481
|
178482
|
183392
|
183393
|
186913
|
186914
|
186915
| 186916 |
187061