Summary: | tools/pdfViewer.pl is vulnerable to displaying the contents of an arbitrary file on the server | ||
---|---|---|---|
Product: | Koha | Reporter: | Galen Charlton <gmcharlt> |
Component: | Architecture, internals, and plumbing | Assignee: | Galen Charlton <gmcharlt> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | critical | ||
Priority: | P1 - high | ||
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Attachments: |
Bug 11660 : tools/pdfViewer.pl is insecure
Bug 11660: remove disused tools/pdfViewer.pl [PASSED QA] Bug 11660: remove disused tools/pdfViewer.pl |
Comment 1
Chris Cormack
2014-02-01 01:23:37 UTC
Comment hidden (obsolete)
Created attachment 24969 [details] [review] Bug 11660: remove disused tools/pdfViewer.pl tools/pdfViewer.pl can be used to read artibrary files on the system. It is actually an unused file, so leaving it around serves no purpose and is dangerous. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Created attachment 24976 [details] [review] [PASSED QA] Bug 11660: remove disused tools/pdfViewer.pl tools/pdfViewer.pl can be used to read artibrary files on the system. It is actually an unused file, so leaving it around serves no purpose and is dangerous. Signed-off-by: Galen Charlton <gmc@esilibrary.com> Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de> No regressions found. Pushed to master. Thanks, Chris! Included in the following releases: 3.8.23, 3.10.13, 3.12.10, and 3.14.3. |