| Summary: | tools/pdfViewer.pl is vulnerable to displaying the contents of an arbitrary file on the server | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Galen Charlton <gmcharlt> |
| Component: | Architecture, internals, and plumbing | Assignee: | Galen Charlton <gmcharlt> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | critical | ||
| Priority: | P1 - high | ||
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Attachments: |
Bug 11660 : tools/pdfViewer.pl is insecure
Bug 11660: remove disused tools/pdfViewer.pl [PASSED QA] Bug 11660: remove disused tools/pdfViewer.pl |
||
|
Comment 1
Chris Cormack
2014-02-01 01:23:37 UTC
Comment hidden (obsolete)
Created attachment 24969 [details] [review] Bug 11660: remove disused tools/pdfViewer.pl tools/pdfViewer.pl can be used to read artibrary files on the system. It is actually an unused file, so leaving it around serves no purpose and is dangerous. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Created attachment 24976 [details] [review] [PASSED QA] Bug 11660: remove disused tools/pdfViewer.pl tools/pdfViewer.pl can be used to read artibrary files on the system. It is actually an unused file, so leaving it around serves no purpose and is dangerous. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> No regressions found. Pushed to master. Thanks, Chris! Included in the following releases: 3.8.23, 3.10.13, 3.12.10, and 3.14.3. |