From 2b7a97be88dcbd6342d694d861dc71a0c38b08ff Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Thu, 25 Sep 2025 11:35:11 +0100 Subject: [PATCH] Bug 39142: (QA follow-up) Add permission checking for syspref overrides This follow-up adds proper security controls for the DISABLE_SYSPREF_* URL parameter functionality introduced in Bug 14004. Previously, any user could bypass system preferences by using URL parameters without authorization. Changes: - Restricts DISABLE_SYSPREF_* parameter processing to users with debug permission - Uses existing haspermission() method for consistent authorization checking - Maintains superlibrarian access as expected - Closes potential security loophole where unauthorized users could disable system preferences like IntranetUserJS and IntranetUserCSS The debug UI buttons will only appear for authorized users, and now the underlying syspref override functionality requires the same permission, ensuring both UI and functional security are aligned. Signed-off-by: Martin Renvoize --- C4/Auth.pm | 33 ++++++++++++++++++--------------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 20242735e1a..f329f83b9fc 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -476,21 +476,24 @@ sub get_template_and_user { # Sysprefs disabled via URL param # Note that value must be defined in order to override via ENV - foreach my $syspref ( - qw( - OPACUserCSS - OPACUserJS - IntranetUserCSS - IntranetUserJS - OpacAdditionalStylesheet - opaclayoutstylesheet - intranetcolorstylesheet - intranetstylesheet - ) - ) - { - $ENV{"OVERRIDE_SYSPREF_$syspref"} = q{} - if $in->{'query'}->param("DISABLE_SYSPREF_$syspref"); + # Only allow syspref overrides for users with debug permission + if ( C4::Context->userenv && haspermission( C4::Context->userenv->{'id'}, { debug => 1 } ) ) { + foreach my $syspref ( + qw( + OPACUserCSS + OPACUserJS + IntranetUserCSS + IntranetUserJS + OpacAdditionalStylesheet + opaclayoutstylesheet + intranetcolorstylesheet + intranetstylesheet + ) + ) + { + $ENV{"OVERRIDE_SYSPREF_$syspref"} = q{} + if $in->{'query'}->param("DISABLE_SYSPREF_$syspref"); + } } # Anonymous opac search history -- 2.51.0