Bugzilla – Attachment 6984 Details for
Bug 6627
[security] insecure file creation
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 6627 [Signed Off] - Update to improve security in specified log files - bug 6627
Bug-6627-Signed-Off---Update-to-improve-security-i.patch (text/plain), 4.25 KB, created by
Liz Rea
on 2011-12-30 19:39:39 UTC
(
hide
)
Description:
Bug 6627 [Signed Off] - Update to improve security in specified log files - bug 6627
Filename:
MIME Type:
Creator:
Liz Rea
Created:
2011-12-30 19:39:39 UTC
Size:
4.25 KB
patch
obsolete
>From 3c2c63a1c722220f17228efa1ec327b36452769b Mon Sep 17 00:00:00 2001 >From: Duncan Tyler <duncan@catalyst.net.nz> >Date: Wed, 21 Dec 2011 14:59:21 +1300 >Subject: [PATCH] Bug 6627 [Signed Off] - Update to improve security in > specified log files - bug 6627 >Content-Type: text/plain; charset="utf-8" > >Signed-off-by: Liz Rea <wizzyrea@gmail.com> >Verified sessionlog file is not written to /tmp when patch is applied. Also verified original bug - logging in did in fact log to /tmp. >--- > C4/Auth.pm | 8 ++++---- > C4/Print.pm | 10 +++++++++- > installer/InstallAuth.pm | 3 ++- > 3 files changed, 15 insertions(+), 6 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index e360e10..bbe472b 100755 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -703,7 +703,7 @@ sub checkauth { > $session->flush; > $session->delete(); > C4::Context->_unset_userenv($sessionID); >- _session_log(sprintf "%20s from %16s logged out at %30s (manually).\n", $userid,$ip,(strftime "%c",localtime)); >+ #_session_log(sprintf "%20s from %16s logged out at %30s (manually).\n", $userid,$ip,(strftime "%c",localtime)); > $sessionID = undef; > $userid = undef; > >@@ -716,7 +716,7 @@ sub checkauth { > $info{'timed_out'} = 1; > $session->delete(); > C4::Context->_unset_userenv($sessionID); >- _session_log(sprintf "%20s from %16s logged out at %30s (inactivity).\n", $userid,$ip,(strftime "%c",localtime)); >+ #_session_log(sprintf "%20s from %16s logged out at %30s (inactivity).\n", $userid,$ip,(strftime "%c",localtime)); > $userid = undef; > $sessionID = undef; > } >@@ -727,7 +727,7 @@ sub checkauth { > $info{'different_ip'} = 1; > $session->delete(); > C4::Context->_unset_userenv($sessionID); >- _session_log(sprintf "%20s from %16s logged out at %30s (ip changed to %16s).\n", $userid,$ip,(strftime "%c",localtime), $info{'newip'}); >+ #_session_log(sprintf "%20s from %16s logged out at %30s (ip changed to %16s).\n", $userid,$ip,(strftime "%c",localtime), $info{'newip'}); > $sessionID = undef; > $userid = undef; > } >@@ -765,7 +765,7 @@ sub checkauth { > $userid = $retuserid if ($retuserid ne ''); > } > if ($return) { >- _session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); >+ #_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); > if ( $flags = haspermission( $userid, $flagsrequired ) ) { > $loggedin = 1; > } >diff --git a/C4/Print.pm b/C4/Print.pm >index 2ba7584d..f810816 100644 >--- a/C4/Print.pm >+++ b/C4/Print.pm >@@ -79,7 +79,8 @@ sub remoteprint ($$) { > # to have spaces in them). Or perhaps if $queue eq "" and > # $env->{file} ne "", then that should mean "print to $env->{file}". > if ( $queue eq "" || $queue eq 'nulllp' ) { >- open( PRINTER, ">/tmp/kohaiss" ); >+ return; >+ #open( PRINTER, ">/tmp/kohaiss" ); > } > else { > >@@ -125,6 +126,10 @@ sub remoteprint ($$) { > } > > sub printreserve { >+ >+ # FIXME - make useful >+ return; >+ > my ( $branchname, $bordata, $itemdata ) = @_; > my $printer = ''; > (return) unless ( C4::Context->boolean_preference('printreserveslips') ); >@@ -175,6 +180,9 @@ print a slip for the given $borrowernumber > > #' > sub printslip ($) { >+ >+ #FIXME - make useful >+ > my $borrowernumber = shift; > my $borrower = GetMemberDetails($borrowernumber); > my $issueslist = GetPendingIssues($borrowernumber); >diff --git a/installer/InstallAuth.pm b/installer/InstallAuth.pm >index 10cbea3..ccdcbcb 100644 >--- a/installer/InstallAuth.pm >+++ b/installer/InstallAuth.pm >@@ -274,7 +274,8 @@ sub checkauth { > C4::Context->_unset_userenv($sessionID); > $sessionID = undef; > $userid = undef; >- open L, ">>/tmp/sessionlog"; >+ # Commented out due to its lack of usefulness >+ # open L, ">>/tmp/sessionlog"; > my $time = localtime( time() ); > printf L "%20s from %16s logged out at %30s (manually).\n", $userid, > $ip, $time; >-- >1.7.5.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 6627
:
6897
| 6984