From 717ea8498ee9b97e8fdd0bfaad0334418fd076cd Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Wed, 18 Sep 2019 10:46:29 +0100 Subject: [PATCH] Bug 23634: Prevent superlibrarian password resets via the OPAC This patch adds a check to opac-password-recovery to prevent a superlibrarian level account from being allowed to request a password reset. It prevents a privilages escalation attack vector. Test plan 1) Create a user with just 'staffaccess' and 'edit_borrowers' permissions. 2) Use that to update the email address of any superlibrarian user. 3) Navigate to the OPAC and request a password reset for the superlibrarian user using the new email address added in the previous step 4) Follow the password reset to it's end and login as the superlibrarian. 5) Apply patch and note that step 3 fails above. Signed-off-by: Tomas Cohen Arazi --- opac/opac-password-recovery.pl | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/opac/opac-password-recovery.pl b/opac/opac-password-recovery.pl index a695165b56..3aed8a2298 100755 --- a/opac/opac-password-recovery.pl +++ b/opac/opac-password-recovery.pl @@ -77,7 +77,9 @@ if ( $query->param('sendEmail') || $query->param('resendEmail') ) { } elsif ( $borrower = $search_results->next() ) { # One matching borrower - if ( $borrower->category->effective_reset_password ) { + if ( !$borrower->has_permission('superlibrarian') + && $borrower->category->effective_reset_password ) + { my @emails = grep { $_ } ( $borrower->email, $borrower->emailpro, $borrower->B_email ); -- 2.23.0