Bug 29542

Summary: User with 'catalogue' permission can view everybody's (private) virtualshelves
Product: Koha Reporter: Joonas Kylmälä <joonas.kylmala>
Component: Staff interfaceAssignee: Jonathan Druart <jonathan.druart>
Status: Pushed to oldoldoldstable --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: 1joynelson, andrewfh, dcook, fridolin.somers, gmcharlt, jonathan.druart, katrin.fischer, lucas, m.de.rooy, martin.renvoize, nick, nugged, victor, wainuiwitikapark
Version: master   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.05.00,21.11.02,21.05.09,20.11.14,19.11.25
Attachments: Bug 29542: Check permission to view list in sendshelf
Bug 29542: Prevent access to private list to non authorized users
Bug 29542: Prevent access to private list to non authorized users
Bug 29542: Prevent access to private list to non authorized users

Description Joonas Kylmälä 2021-11-20 20:01:12 UTC
Any user with just 'catalogue' permission can view everybody's virtualshelves lists by sending them to their wanted email address by just going to this URL:

localhost:8081/cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XXX

Gladly the borrower's details are not included in that but however the list name is, and that might contain some private information relating to the patron, e.g. maybe they named the list after their own name "John's favorite books"
Comment 1 Marcel de Rooy 2021-11-22 07:44:03 UTC
Created attachment 127914 [details] [review]
Bug 29542: Check permission to view list in sendshelf

Test plan:
Find a (private) list that you should not be able to view.
Try the URL /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=[list_number]
You should see an error message. (Which could surely be improved on
another report.)

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 2 Marcel de Rooy 2021-12-22 14:37:10 UTC
Triggering more attention for this bug by changing status ;)
Comment 3 Katrin Fischer 2022-01-02 16:00:22 UTC
I am not sure about the solution here, because now you still get to see the email form, the error only appears after you tried to send the list.

Could we prevent showing the form and show the error right away?
Comment 4 Jonathan Druart 2022-01-05 14:58:32 UTC
Created attachment 129030 [details] [review]
Bug 29542: Prevent access to private list to non authorized users

The catalogue permission is not enough.

Test plan:
Create a private list owned by user A
Login with user B and hit (with XX the shelfid)
  /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX

You should get an error message "You do not have sufficient permission
to continue."

Login with user A
=> You should be able to send the list
Comment 5 Jonathan Druart 2022-01-05 14:59:34 UTC
We can early exit at the top of the script and use output_and_exit && blocking_error.inc
Comment 6 Katrin Fischer 2022-01-06 18:19:27 UTC
Created attachment 129108 [details] [review]
Bug 29542: Prevent access to private list to non authorized users

The catalogue permission is not enough.

Test plan:
Create a private list owned by user A
Login with user B and hit (with XX the shelfid)
  /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX

You should get an error message "You do not have sufficient permission
to continue."

Login with user A
=> You should be able to send the list

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 7 Tomás Cohen Arazi 2022-01-12 12:21:47 UTC
Created attachment 129335 [details] [review]
Bug 29542: Prevent access to private list to non authorized users

The catalogue permission is not enough.

Test plan:
Create a private list owned by user A
Login with user B and hit (with XX the shelfid)
  /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX

You should get an error message "You do not have sufficient permission
to continue."

Login with user A
=> You should be able to send the list

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 8 Victor Grousset/tuxayo 2022-01-27 20:52:02 UTC
Backported: Pushed to 20.11.x-security branch for 20.11.14
Comment 9 Andrew Fuerste-Henry 2022-01-28 14:20:02 UTC
Pushed to security/21.05.x for 21.05.09
Comment 10 wainuiwitikapark 2022-01-30 23:36:07 UTC
Backported to 19.11.x-security branch on the Security repo for 19.11.25 security release.