Bug 23872

Summary: ManaKB Permissions can be subverted
Product: Koha Reporter: Martin Renvoize <martin.renvoize>
Component: Mana-kbAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact:
Severity: normal    
Priority: P5 - low CC: jonathan.druart
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:

Description Martin Renvoize 2019-10-22 12:50:55 UTC
Granular permissions for managing Mana-KB preferences were added with bug 22198 but access to those system preferences via the standard preferences page was not locked down.. 

As such, we have a hole in the permissions logic here.
Comment 1 Jonathan Druart 2019-10-24 14:27:40 UTC
Can you detail? I do not get it.
Comment 2 Martin Renvoize 2019-10-24 14:39:13 UTC
Test plan

1) Add a new user with 'manage_sysprefs' permission.
2) Note that this user can change Mana related sytem preferences via `Home › Administration › System preferences > Web services > Mana KB` regardless of whether that also have the `manage_mana` permission or not.

Note: This is actually the same case for HEA prefs too.
Comment 3 Jonathan Druart 2019-10-24 15:48:05 UTC
Do we really need this specific permission?
I would go for removing manage_mana and use manage_sysprefs instead. Or, if we really need it, add a warning in the pref's description.