From 4ed83f5a9c10b899cbfb1d7d70fa1307da3dcf7e Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Wed, 18 Sep 2019 10:46:29 +0100 Subject: [PATCH] Bug 23634: Prevent superlibrarian password resets via the OPAC This aptch adds a check to opac-password-recovery to prevent a superlibrarian level account from being allowed to request a password reset. It prevents a privilages escalation attack vector. Test plan 1) Create a user with just 'staffaccess' and 'edit_borrowers' permissions. 2) Use that to update the email address of any superlibrarian user. 3) Navigate to the OPAC and request a password reset for the superlibrarian user using the new email address added in the previous step 4) Follow the password reset to it's end and login as the superlibrarian. 5) Apply patch and note that step 3 fails above. --- opac/opac-password-recovery.pl | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/opac/opac-password-recovery.pl b/opac/opac-password-recovery.pl index a695165b56..3aed8a2298 100755 --- a/opac/opac-password-recovery.pl +++ b/opac/opac-password-recovery.pl @@ -77,7 +77,9 @@ if ( $query->param('sendEmail') || $query->param('resendEmail') ) { } elsif ( $borrower = $search_results->next() ) { # One matching borrower - if ( $borrower->category->effective_reset_password ) { + if ( !$borrower->has_permission('superlibrarian') + && $borrower->category->effective_reset_password ) + { my @emails = grep { $_ } ( $borrower->email, $borrower->emailpro, $borrower->B_email ); -- 2.20.1