Summary: | Access Control - Malicious user can delete the search history of another user | ||
---|---|---|---|
Product: | Koha | Reporter: | am |
Component: | OPAC | Assignee: | Jonathan Druart <jonathan.druart> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | major | ||
Priority: | P5 - low | CC: | brendan, chris, f.demians, fridolin.somers, jonathan.druart, julian.maurice, jweaver, kyle, mtj |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: | ||
Bug Depends on: | 11430 | ||
Bug Blocks: | |||
Attachments: |
Bug 16593: Do not allow patrons to delete search history of others patrons
Bug 16593: Do not allow patrons to delete search history of others patrons Bug 16593: Do not allow patrons to delete search history of others patrons |
Description
am
2016-05-25 16:54:54 UTC
Created attachment 51823 [details] [review] Bug 16593: Do not allow patrons to delete search history of others patrons A malicious user can delete the search history of all other users by correctly guessing the ID value assigned to the victim's search. As searches are assigned values sequentially, an attacker could quickly remove the searches belonging to all of the application's users. To reproduce: Login with patron A launch a search Note the id generated for this search history: select id from search_history order by id desc limit 1; Login with patron B Hit /cgi-bin/koha/opac-search-history.pl?action=delete&id=<ID> Note that the row is deleted in the DB Test plan Confirm that this patch fixes the issue. The same test can be made at the staff interface Reported by Alex Middleton at Dionach Created attachment 51826 [details] [review] Bug 16593: Do not allow patrons to delete search history of others patrons A malicious user can delete the search history of all other users by correctly guessing the ID value assigned to the victim's search. As searches are assigned values sequentially, an attacker could quickly remove the searches belonging to all of the application's users. To reproduce: Login with patron A launch a search Note the id generated for this search history: select id from search_history order by id desc limit 1; Login with patron B Hit /cgi-bin/koha/opac-search-history.pl?action=delete&id=<ID> Note that the row is deleted in the DB Test plan Confirm that this patch fixes the issue. The same test can be made at the staff interface Reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Created attachment 52494 [details] [review] Bug 16593: Do not allow patrons to delete search history of others patrons A malicious user can delete the search history of all other users by correctly guessing the ID value assigned to the victim's search. As searches are assigned values sequentially, an attacker could quickly remove the searches belonging to all of the application's users. To reproduce: Login with patron A launch a search Note the id generated for this search history: select id from search_history order by id desc limit 1; Login with patron B Hit /cgi-bin/koha/opac-search-history.pl?action=delete&id=<ID> Note that the row is deleted in the DB Test plan Confirm that this patch fixes the issue. The same test can be made at the staff interface Reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Pushed to master for 16.11, thanks Jonathan! Pushed in 16.05. Will be in 16.05.02. Pushed to 3.20.x will be in 3.20.14 Patch pushed to 3.22.x, will be in 3.22.10 |