Summary: | Any authenticated OPAC user can run opac-dismiss-message.pl for any user/any message | ||
---|---|---|---|
Product: | Koha | Reporter: | David Cook <dcook> |
Component: | OPAC | Assignee: | Jonathan Druart <jonathan.druart> |
Status: | Pushed to oldstable --- | QA Contact: | David Cook <dcook> |
Severity: | normal | ||
Priority: | P5 - low | CC: | dcook, didier.gautheron, fridolin.somers, jonathan.druart, laurent.ducos, lisette, lucas, m.de.rooy, nick, philippe.blouin, tomascohen, wainuiwitikapark |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
24.05.00,23.11.05,23.05.11
|
|
Circulation function: | |||
Bug Depends on: | 12029 | ||
Bug Blocks: | |||
Attachments: |
Bug 36532: Protect opac-dismiss-message.pl from malicious usages
Bug 36532: Protect opac-dismiss-message.pl from malicious usages Bug 36532: Protect opac-dismiss-message.pl from malicious usages |
Description
David Cook
2024-04-05 05:44:02 UTC
Created attachment 164450 [details] [review] Bug 36532: Protect opac-dismiss-message.pl from malicious usages Really bad design, NEVER retrieve the logged in user from the CGI param! See comment 1 for more info Created attachment 164484 [details] [review] Bug 36532: Protect opac-dismiss-message.pl from malicious usages Really bad design, NEVER retrieve the logged in user from the CGI param! See comment 1 for more info Signed-off-by: Owen Leonard <oleonard@myacpl.org> Created attachment 164526 [details] [review] Bug 36532: Protect opac-dismiss-message.pl from malicious usages Really bad design, NEVER retrieve the logged in user from the CGI param! See comment 1 for more info Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: David Cook <dcook@prosentient.com.au> Great job, Jonathan. Thanks for taking care of this one. Applied to 22.05.x-security I am getting the following error on jenkins: "xt_find_cud_t.This branch is not supposed to have 'cud-', see bug 34478. (2034)" https://jenkins.koha-community.org/job/Koha_Sec/job/Koha_22.05/lastCompletedBuild/testReport/(root)/xt_find_cud_t/This_branch_is_not_supposed_to_have__cud____see_bug_34478___2034_/ I ran the prove xt/find-cud.t and got the following output: kohadev-koha@kohadevbox:koha((9733fdbbcbf...))$ prove xt/find-cud.t xt/find-cud.t .. 1/1 # Failed test 'This branch is not supposed to have 'cud-', see bug 34478.' # at xt/find-cud.t line 25. # got: '2' # expected: '0' # $VAR1 = [ # 'koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc: <input type="hidden" name="op" value="cud-update" />', # 'opac/opac-routing-lists.pl:unless ( $op =~ /^cud-/ && $message ) {' # ]; # Looks like you failed 1 test of 1. xt/find-cud.t .. Dubious, test returned 1 (wstat 256, 0x100) Failed 1/1 subtests Test Summary Report ------------------- xt/find-cud.t (Wstat: 256 (exited 1) Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 Files=1, Tests=1, 0 wallclock secs ( 0.01 usr 0.01 sys + 0.09 cusr 0.20 csys = 0.31 CPU) Result: FAIL Which says there is something wrong with the following files - koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc - opac/opac-routing-lists.pl And those files were changed in this bug - and have added "cud-" Is there a way that I can fix this failing test? Oh I am also getting the following error which also seems to be related to this bug https://jenkins.koha-community.org/job/Koha_Sec/job/Koha_22.05/lastCompletedBuild/testReport/(root)/t_db_dependent_00_strict_t/Syntax_check_opac_opac_routing_lists_pl__1798_/ Please help :) (In reply to wainuiwitikapark from comment #8) > Oh I am also getting the following error which also seems to be related to > this bug > https://jenkins.koha-community.org/job/Koha_Sec/job/Koha_22.05/ > lastCompletedBuild/testReport/(root)/t_db_dependent_00_strict_t/ > Syntax_check_opac_opac_routing_lists_pl__1798_/ > > Please help :) I think you can just revert as the base feature doesn't exist in 22.05 This doesn't apply because the dependency https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12029 isn't in 22.05 (In reply to wainuiwitikapark from comment #6) > Applied to 22.05.x-security Reverted this out of 22.05 Pushed for 24.05! Well done everyone, thank you! Arg, I see it is in 22.11.x but depends on Bug 12029 only since 23.05 https://git.koha-community.org/Koha-community/Koha/commit/2278d229e899cd279f62addd8275365718ad8cbb I've done a message to @fredericdemians in chat (In reply to Fridolin Somers from comment #14) > I've done a message to @fredericdemians in chat Seeing that it was reverted in 22.11.x |