Bugzilla – Attachment 92998 Details for
Bug 23634
Privilege escalation vulnerability for staff users with 'edit_borrowers' permission and 'OpacResetPassword' enabled
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 23634: Prevent superlibrarian password resets via the OPAC
Bug-23634-Prevent-superlibrarian-password-resets-v.patch (text/plain), 1.65 KB, created by
Tomás Cohen Arazi (tcohen)
on 2019-09-20 14:13:38 UTC
(
hide
)
Description:
Bug 23634: Prevent superlibrarian password resets via the OPAC
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi (tcohen)
Created:
2019-09-20 14:13:38 UTC
Size:
1.65 KB
patch
obsolete
>From 717ea8498ee9b97e8fdd0bfaad0334418fd076cd Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Wed, 18 Sep 2019 10:46:29 +0100 >Subject: [PATCH] Bug 23634: Prevent superlibrarian password resets via the > OPAC > >This patch adds a check to opac-password-recovery to prevent a >superlibrarian level account from being allowed to request a password >reset. It prevents a privilages escalation attack vector. > >Test plan >1) Create a user with just 'staffaccess' and 'edit_borrowers' >permissions. >2) Use that to update the email address of any superlibrarian user. >3) Navigate to the OPAC and request a password reset for the > superlibrarian user using the new email address added in the previous > step >4) Follow the password reset to it's end and login as the > superlibrarian. >5) Apply patch and note that step 3 fails above. > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > opac/opac-password-recovery.pl | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > >diff --git a/opac/opac-password-recovery.pl b/opac/opac-password-recovery.pl >index a695165b56..3aed8a2298 100755 >--- a/opac/opac-password-recovery.pl >+++ b/opac/opac-password-recovery.pl >@@ -77,7 +77,9 @@ if ( $query->param('sendEmail') || $query->param('resendEmail') ) { > } > elsif ( $borrower = $search_results->next() ) { # One matching borrower > >- if ( $borrower->category->effective_reset_password ) { >+ if ( !$borrower->has_permission('superlibrarian') >+ && $borrower->category->effective_reset_password ) >+ { > > my @emails = grep { $_ } ( $borrower->email, $borrower->emailpro, $borrower->B_email ); > >-- >2.23.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 23634
:
92932
|
92998
|
95563
|
95564
|
95574
|
95575
|
95576
|
95577
|
95582
|
97986
|
97987
|
97988
|
97989
|
97990
|
106159
|
106160
|
106161
|
106162
|
106163
|
106723
|
106724
|
106725
|
106726
|
106727
|
106764
|
106826
|
106837
|
106838
|
106839
|
106840
|
106841
|
106842
|
106843
|
106844
|
106979
|
106980
|
106981
|
106982
|
106983
|
106984
|
106985
|
106986
|
109582