Bug 40993

Summary: Do not allow direct calls of value_builder scripts
Product: Koha Reporter: Marcel de Rooy <m.de.rooy>
Component: Architecture, internals, and plumbingAssignee: Marcel de Rooy <m.de.rooy>
Status: Needs Signoff --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dcook, jonathan.druart
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37041
GIT URL: Change sponsored?: ---
Patch complexity: Trivial patch Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on: 40943    
Bug Blocks:    
Attachments: Bug 40993: Add Apache RewriteRule for hitting value_builder pages

Description Marcel de Rooy 2025-10-10 09:42:55 UTC
See 37041/40943. On 40943 we check the correct session id now. But we still should not hit those value builder pages directly and generate 500s.
But the login problem of 37041 has been addressed.
Comment 1 Marcel de Rooy 2025-10-10 09:59:10 UTC
Created attachment 187723 [details] [review]
Bug 40993: Add Apache RewriteRule for hitting value_builder pages

Test plan:
Copy this file to /etc/koha.
Restart Apache.
Login to staff and hit a value builder page directly, e.g.:
YOUR_SERVER/cgi-bin/koha/cataloguing/value_builder/marc21_field_005.pl
Verify that you got redirected to 403.
Verify that you can still edit a biblio record and open e.g. the leader
plugin form.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 2 Marcel de Rooy 2025-10-10 10:00:22 UTC
Your follow-up here would be appreciated. Thanks.