Summary: | Patron images can be accessed with just 'catalogue' permission | ||
---|---|---|---|
Product: | Koha | Reporter: | Joonas Kylmälä <joonas.kylmala> |
Component: | Staff interface | Assignee: | Jonathan Druart <jonathan.druart> |
Status: | Pushed to oldoldoldstable --- | QA Contact: | Tomás Cohen Arazi <tomascohen> |
Severity: | critical | ||
Priority: | P5 - low | CC: | 1joynelson, andrewfh, dcook, fridolin.somers, gmcharlt, jonathan.druart, katrin.fischer, lucas, m.de.rooy, martin.renvoize, nick, nugged, tomascohen, victor, wainuiwitikapark |
Version: | master | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
22.05.00,21.11.02,21.05.09,20.11.14,19.11.25
|
|
Bug Depends on: | 17423 | ||
Bug Blocks: | |||
Attachments: |
Bug 29541: Restrict access to patron's image to borrowers => * and circulate => *
Bug 29541: Prevent users from another group to access patron's images Bug 29541: Restrict access to patron's image to borrowers => * and circulate => * Bug 29541: Prevent users from another group to access patron's images Bug 29541: Restrict access to patron's image to borrowers => * and circulate => * Bug 29541: Prevent users from another group to access patron's images |
Description
Joonas Kylmälä
2021-11-20 19:37:12 UTC
I am getting "Error: You do not have permission to access this page." members/moremember.pl requires { borrowers => 'edit_borrowers' } And I am getting a 403 on /cgi-bin/koha/members/patronimage.pl?borrowernumber=51 (In reply to Jonathan Druart from comment #2) > And I am getting a 403 on > /cgi-bin/koha/members/patronimage.pl?borrowernumber=51 Wrong, I am seeing the image. I was expecting the following change to work, but it does not. diff --git a/members/patronimage.pl b/members/patronimage.pl index da62b875536..c4a6e5eb401 100755 --- a/members/patronimage.pl +++ b/members/patronimage.pl @@ -47,7 +47,7 @@ This script, when called from within HTML and passed a valid patron borrowernumb =cut -my ($status, $cookie, $sessionID) = check_api_auth($query, { catalogue => 1 } ); +my ($status, $cookie, $sessionID) = check_api_auth($query, [ { borrowers => '*' }, { circulate => '*' } ] ); unless ( $status eq 'ok' ) { print $query->header(-type => 'text/plain', -status => '403 Forbidden'); Created attachment 127932 [details] [review] Bug 29541: Restrict access to patron's image to borrowers => * and circulate => * The patron images is displayed on the 'circulation' and 'members' modules. (In reply to Jonathan Druart from comment #4) > I was expecting the following change to work, but it does not. > > diff --git a/members/patronimage.pl b/members/patronimage.pl > index da62b875536..c4a6e5eb401 100755 > --- a/members/patronimage.pl > +++ b/members/patronimage.pl > @@ -47,7 +47,7 @@ This script, when called from within HTML and passed a > valid patron borrowernumb > > =cut > > -my ($status, $cookie, $sessionID) = check_api_auth($query, { catalogue => 1 > } ); > +my ($status, $cookie, $sessionID) = check_api_auth($query, [ { borrowers => > '*' }, { circulate => '*' } ] ); > > unless ( $status eq 'ok' ) { > print $query->header(-type => 'text/plain', -status => '403 Forbidden'); It actually works. I have been logged out at some point and haven't noticed... borrowers => * and circulate => * would that works? I am not sure if borrowers * is correct. I think if you are not allowed to see another library's patron data, you should also not be able to access the patron images for these patrons - so we probably need to add library groups into the equation here? Created attachment 128276 [details] [review] Bug 29541: Prevent users from another group to access patron's images We should respect group restrictions here. Test plan: Create a patron from another group of libraries and don't let them access info from patrons outside of this group. Access the following link and confirm that you can see the image only for patrons from their group /cgi-bin/koha/members/patronimage.pl?borrowernumber=XX Created attachment 128801 [details] [review] Bug 29541: Restrict access to patron's image to borrowers => * and circulate => * The patron images is displayed on the 'circulation' and 'members' modules. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Created attachment 128802 [details] [review] Bug 29541: Prevent users from another group to access patron's images We should respect group restrictions here. Test plan: Create a patron from another group of libraries and don't let them access info from patrons outside of this group. Access the following link and confirm that you can see the image only for patrons from their group /cgi-bin/koha/members/patronimage.pl?borrowernumber=XX Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Created attachment 129333 [details] [review] Bug 29541: Restrict access to patron's image to borrowers => * and circulate => * The patron images is displayed on the 'circulation' and 'members' modules. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Created attachment 129334 [details] [review] Bug 29541: Prevent users from another group to access patron's images We should respect group restrictions here. Test plan: Create a patron from another group of libraries and don't let them access info from patrons outside of this group. Access the following link and confirm that you can see the image only for patrons from their group /cgi-bin/koha/members/patronimage.pl?borrowernumber=XX Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Backported: Pushed to 20.11.x branch for 20.11.14 Testing notes: for the 2nd patch the permission for the observing patron is the subpermission "Add, modify and view patron information (edit_borrowers)" and without the next one (view_borrower_infos_from_any_libraries) Then create a group with 2 libraries, confirm that it's possible to see another patron's (from another library) page and image URL. But when removing the library from the group, it's not possible to see the patron's page anymore. Without the patch, the image URL still works! And the patch fixes that. *20.11.x-security branch Backported to 19.11.x-security branch on the Security repo for 19.11.25 security release. Pushed to security 21.05.x for 21.05.09 |