Bugzilla – Attachment 164484 Details for
Bug 36532
Any authenticated OPAC user can run opac-dismiss-message.pl for any user/any message
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 36532: Protect opac-dismiss-message.pl from malicious usages
Bug-36532-Protect-opac-dismiss-messagepl-from-mali.patch (text/plain), 2.29 KB, created by
Owen Leonard
on 2024-04-05 14:43:18 UTC
(
hide
)
Description:
Bug 36532: Protect opac-dismiss-message.pl from malicious usages
Filename:
MIME Type:
Creator:
Owen Leonard
Created:
2024-04-05 14:43:18 UTC
Size:
2.29 KB
patch
obsolete
>From 2c1bd154e14d2d524c20b2ac3e056937747f3001 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Fri, 5 Apr 2024 08:58:06 +0200 >Subject: [PATCH] Bug 36532: Protect opac-dismiss-message.pl from malicious > usages > >Really bad design, NEVER retrieve the logged in user from the CGI >param! > >See comment 1 for more info > >Signed-off-by: Owen Leonard <oleonard@myacpl.org> >--- > .../opac-tmpl/bootstrap/en/includes/opac-note.inc | 1 - > opac/opac-dismiss-message.pl | 12 ++++++++---- > 2 files changed, 8 insertions(+), 5 deletions(-) > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc >index 71cea64f556..4d995b49b87 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc >@@ -10,7 +10,6 @@ > <form id="dismiss-message-form" action="/cgi-bin/koha/opac-dismiss-message.pl" method="post"> > [% INCLUDE 'csrf-token.inc' %] > <input type="hidden" name="message_id" value="[% message.message_id | html %]"> >- <input type="hidden" name="patron_id" value="[% message.borrowernumber | html %]"> > <input type="hidden" name="op" value="cud-update" /> > <button type="submit" class="dismiss-message-button btn btn-primary"><i class="fa fa-trash" aria-hidden="true"></i> Dismiss</button> > </form> >diff --git a/opac/opac-dismiss-message.pl b/opac/opac-dismiss-message.pl >index 9c3efe6b25d..9ee8f61eb71 100755 >--- a/opac/opac-dismiss-message.pl >+++ b/opac/opac-dismiss-message.pl >@@ -36,10 +36,14 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( > } > ); > >-my $patron_id = $query->param('patron_id'); >-my $patron = Koha::Patrons->find( $patron_id ); >-my $message_id = $query->param('message_id'); >-my $message = $patron->messages->find( $message_id ); >+my $logged_in_user = Koha::Patrons->find($borrowernumber); >+my $message_id = $query->param('message_id'); >+my $message = $logged_in_user->messages->find($message_id); >+ >+unless ($message) { >+ print $query->redirect("/cgi-bin/koha/errors/404.pl"); >+ exit; >+} > > unless ( $op =~ /^cud-/ && $message ) { > # exit early >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 36532
:
164450
|
164484
|
164526