Bug 11660

Summary: tools/pdfViewer.pl is vulnerable to displaying the contents of an arbitrary file on the server
Product: Koha Reporter: Galen Charlton <gmcharlt>
Component: Architecture, internals, and plumbingAssignee: Galen Charlton <gmcharlt>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: critical    
Priority: P1 - high    
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 11660 : tools/pdfViewer.pl is insecure
Bug 11660: remove disused tools/pdfViewer.pl
[PASSED QA] Bug 11660: remove disused tools/pdfViewer.pl

Comment 1 Chris Cormack 2014-02-01 01:23:37 UTC Comment hidden (obsolete)
Comment 2 Galen Charlton 2014-02-01 02:17:26 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2014-02-01 16:37:52 UTC
Created attachment 24976 [details] [review]
[PASSED QA] Bug 11660: remove disused tools/pdfViewer.pl

tools/pdfViewer.pl can be used to read artibrary files on the system.

It is actually an unused file, so leaving it around serves no purpose
and is dangerous.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
No regressions found.
Comment 4 Galen Charlton 2014-02-07 01:41:10 UTC
Pushed to master.  Thanks, Chris!
Comment 5 Galen Charlton 2014-02-07 02:05:34 UTC
Included in the following releases: 3.8.23, 3.10.13, 3.12.10, and 3.14.3.