From 979a4dbafb2ff03072717a07d8748280b458d67d Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Thu, 25 Sep 2025 11:35:11 +0100 Subject: [PATCH] Bug 39142: (QA follow-up) Add permission checking for syspref overrides This follow-up adds proper security controls for the DISABLE_SYSPREF_* URL parameter functionality introduced in Bug 14004. Previously, any user could bypass system preferences by using URL parameters without authorization. Changes: - Restricts DISABLE_SYSPREF_* parameter processing to users with debug permission - Uses existing haspermission() method for consistent authorization checking - Maintains superlibrarian access as expected - Closes potential security loophole where unauthorized users could disable system preferences like IntranetUserJS and IntranetUserCSS The debug UI buttons will only appear for authorized users, and now the underlying syspref override functionality requires the same permission, ensuring both UI and functional security are aligned. Signed-off-by: Martin Renvoize --- C4/Auth.pm | 33 ++++++++++++++++++--------------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 9776e8bc442..c6c8116d69e 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -476,21 +476,24 @@ sub get_template_and_user { # Sysprefs disabled via URL param # Note that value must be defined in order to override via ENV - foreach my $syspref ( - qw( - OPACUserCSS - OPACUserJS - IntranetUserCSS - IntranetUserJS - OpacAdditionalStylesheet - opaclayoutstylesheet - intranetcolorstylesheet - intranetstylesheet - ) - ) - { - $ENV{"OVERRIDE_SYSPREF_$syspref"} = q{} - if $in->{'query'}->param("DISABLE_SYSPREF_$syspref"); + # Only allow syspref overrides for users with debug permission + if ( C4::Context->userenv && haspermission( C4::Context->userenv->{'id'}, { debug => 1 } ) ) { + foreach my $syspref ( + qw( + OPACUserCSS + OPACUserJS + IntranetUserCSS + IntranetUserJS + OpacAdditionalStylesheet + opaclayoutstylesheet + intranetcolorstylesheet + intranetstylesheet + ) + ) + { + $ENV{"OVERRIDE_SYSPREF_$syspref"} = q{} + if $in->{'query'}->param("DISABLE_SYSPREF_$syspref"); + } } # Anonymous opac search history -- 2.51.1