Bugzilla – Attachment 70923 Details for
Bug 20083
Information disclosure when (mis)using the MARC Preview feature
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 20083 - Information disclosure when (mis)using the MARC Preview feature
Bug-20083---Information-disclosure-when-misusing-t.patch (text/plain), 2.63 KB, created by
Liz Rea
on 2018-01-26 01:14:36 UTC
(
hide
)
Description:
Bug 20083 - Information disclosure when (mis)using the MARC Preview feature
Filename:
MIME Type:
Creator:
Liz Rea
Created:
2018-01-26 01:14:36 UTC
Size:
2.63 KB
patch
obsolete
>From d1eda960f25bdab06dcef383c0b64488042c029a Mon Sep 17 00:00:00 2001 >From: Liz Rea <liz@catalyst.net.nz> >Date: Fri, 26 Jan 2018 14:12:47 +1300 >Subject: [PATCH] Bug 20083 - Information disclosure when (mis)using the MARC > Preview feature > >The MARC Preview feature in the Staff client (catalogue/showmarc.pl) does not >check whether a user is logged in or not. As a consequence, it can be used to >obtain information that would normally be available to logged-in users only. >For example, you can view any bibliographic record by passing a value to the >'id' argument, but you can also view records as they were imported (normally >done via the 'Staged MARC management' tool). > >All three 17.11 installations currently listed at >https://wiki.koha-community.org/wiki/Koha_Demo_Installations >are affected by this issue, as demonstrated by the URLs below: > >http://koha.adminkuhn.ch:8080/cgi-bin/koha/catalogue/showmarc.pl?importid=1&viewas=html >http://pro.demo1711-koha.test.biblibre.eu/cgi-bin/koha/catalogue/showmarc.pl?id=1000&viewas=html >https://staff-kohademo.equinoxinitiative.org/cgi-bin/koha/catalogue/showmarc.pl?id=1&viewas=html > >It should be noted that this only applies to XSLT-enabled installations. > >- note that I (Liz) am only putting this patch in a testable form, patch/changes written by Andreas Roussos >--- > catalogue/showmarc.pl | 21 +++++++++++---------- > 1 file changed, 11 insertions(+), 10 deletions(-) > >diff --git a/catalogue/showmarc.pl b/catalogue/showmarc.pl >index 11c4f39..2d5c193 100755 >--- a/catalogue/showmarc.pl >+++ b/catalogue/showmarc.pl >@@ -37,6 +37,17 @@ use C4::ImportBatch; > use C4::XSLT (); > > my $input= new CGI; >+my ( $template, $loggedinuser, $cookie ) = get_template_and_user( >+ { >+ template_name => "catalogue/showmarc.tt", >+ query => $input, >+ type => "intranet", >+ authnotrequired => 0, >+ flagsrequired => { catalogue => 1 }, >+ debug => 1, >+ } >+); >+ > my $biblionumber= $input->param('id'); > my $importid= $input->param('importid'); > my $view= $input->param('viewas')||''; >@@ -70,16 +81,6 @@ if($view eq 'card' || $view eq 'html') { > Encode::encode_utf8(C4::XSLT::engine->transform($xml, $xsl)); > } > else { >- my ( $template, $loggedinuser, $cookie ) = get_template_and_user( >- { >- template_name => "catalogue/showmarc.tt", >- query => $input, >- type => "intranet", >- authnotrequired => 0, >- flagsrequired => { catalogue => 1 }, >- debug => 1, >- } >- ); > $template->param( MARC_FORMATTED => $record->as_formatted ); > output_html_with_http_headers $input, $cookie, $template->output; > } >-- >2.7.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 20083
:
70872
|
70923
|
70924
|
70929
|
70931
|
71077
|
71084