Bugzilla – Attachment 100882 Details for
Bug 24878
Authentication check missing on calendar tools
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 24878: Add authentication checks to the calendar tool
Bug-24878-Add-authentication-checks-to-the-calenda.patch (text/plain), 1.95 KB, created by
Nick Clemens
on 2020-03-17 10:35:02 UTC
(
hide
)
Description:
Bug 24878: Add authentication checks to the calendar tool
Filename:
MIME Type:
Creator:
Nick Clemens
Created:
2020-03-17 10:35:02 UTC
Size:
1.95 KB
patch
obsolete
>From edce171800fd9ef55323879f55328df3b367a31f Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Mon, 16 Mar 2020 16:26:48 +0100 >Subject: [PATCH] Bug 24878: Add authentication checks to the calendar tool > >There is a security hole in 2 scripts that are used by the UI to edit >holidays. > >To test: >1) Go to Tools -> Calendar, for Centerville > Check no holiday for 30/4/2020 >2) To add a new holiday without login execute > a curl command with necessary parameters >3) Reload page from 1), verify the new holiday > edit and delete the holiday >4) Apply the patch >5) Do 2) again, this time you get a lengthy output, > with the magic words: > > <title>Koha › > Log in to Koha > </title> > >Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com> >Only tested newHoliday but the fix is the same. >No errors > >Signed-off-by: Nick Clemens <nick@bywatersolutions.com> >--- > tools/exceptionHolidays.pl | 3 +++ > tools/newHolidays.pl | 2 ++ > 2 files changed, 5 insertions(+) > >diff --git a/tools/exceptionHolidays.pl b/tools/exceptionHolidays.pl >index 90b17bc6cf..1f3b9672fb 100755 >--- a/tools/exceptionHolidays.pl >+++ b/tools/exceptionHolidays.pl >@@ -14,6 +14,9 @@ use Koha::DateUtils; > my $input = new CGI; > my $dbh = C4::Context->dbh(); > >+checkauth($input, 0, {tools=> 'edit_calendar'}, 'intranet'); >+ >+ > my $branchcode = $input->param('showBranchName'); > my $weekday = $input->param('showWeekday'); > my $day = $input->param('showDay'); >diff --git a/tools/newHolidays.pl b/tools/newHolidays.pl >index a161eaf1c8..f13e52447b 100755 >--- a/tools/newHolidays.pl >+++ b/tools/newHolidays.pl >@@ -33,6 +33,8 @@ use Koha::DateUtils; > my $input = new CGI; > my $dbh = C4::Context->dbh(); > >+checkauth($input, 0, {tools=> 'edit_calendar'}, 'intranet'); >+ > our $branchcode = $input->param('newBranchName'); > my $originalbranchcode = $branchcode; > our $weekday = $input->param('newWeekday'); >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 24878
:
100764
|
100837
| 100882 |
100883
|
100884