| Summary: | CSRF-vulnerability in opac-patron-consent.pl. | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Andreas Jonsson <andreas.jonsson> |
| Component: | OPAC | Assignee: | David Cook <dcook> |
| Status: | Pushed to oldoldstable --- | QA Contact: | Marcel de Rooy <m.de.rooy> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | dcook, didier.gautheron, fridolin.somers, jonathan.druart, katrin.fischer, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, phil, philippe.blouin, tomascohen, wainuiwitikapark |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
26.05.00,25.05.07,25.11.01,24.11.12,22.11.34
|
|
| Circulation function: | |||
| Attachments: |
Bug 41662: Prevent CSRF on opac-patron-consent.pl
Bug 41662: Prevent CSRF on opac-patron-consent.pl |
||
|
Description
Andreas Jonsson
2026-01-19 15:03:39 UTC
Will have a look I can't reproduce this on main (In reply to David Cook from comment #2) > I can't reproduce this on main Because it was a bad test. It should be: /cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=0 /cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=1 (In reply to Marcel de Rooy from comment #1) > Will have a look Sorry to steal the assignee from you Marcel. I've got a patch all ready to go here. Created attachment 191658 [details] [review] Bug 41662: Prevent CSRF on opac-patron-consent.pl This change prevents CSRF on opac-patron-consent.pl by adding checking of the "op". Test plan: 0. Apply the patch and koha-plack --restart kohadev 1. Set system preference PrivacyPolicyConsent to "permissive" 2. Log into the OPAC and go to this path: /cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=1 3. Note that it doesn't change the consent 4. Go to this path: /cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=0 5. Note that it doesn't change the consent 6. Click the "Yes" radio button and click "Save" 7. Note it changes the consent to Yes 8. Click the "No" radio button and click "Save" 9. Note it changes the consent to No (In reply to David Cook from comment #4) > (In reply to Marcel de Rooy from comment #1) > > Will have a look > > Sorry to steal the assignee from you Marcel. I've got a patch all ready to > go here. How can I report a stolen security report ? Created attachment 191672 [details] [review] Bug 41662: Prevent CSRF on opac-patron-consent.pl This change prevents CSRF on opac-patron-consent.pl by adding checking of the "op". Test plan: 0. Apply the patch and koha-plack --restart kohadev 1. Set system preference PrivacyPolicyConsent to "permissive" 2. Log into the OPAC and go to this path: /cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=1 3. Note that it doesn't change the consent 4. Go to this path: /cgi-bin/koha/opac-patron-consent.pl?check_GDPR_PROCESSING=0 5. Note that it doesn't change the consent 6. Click the "Yes" radio button and click "Save" 7. Note it changes the consent to Yes 8. Click the "No" radio button and click "Save" 9. Note it changes the consent to No Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Combined SO+QA, trivial patch. Please provide patches for all currently supported versions. (In reply to Lucas Gass (lukeg) from comment #9) > Please provide patches for all currently supported versions. +1 I cannot apply cleanly to 22.11 (In reply to Wainui Witika-Park from comment #10) > (In reply to Lucas Gass (lukeg) from comment #9) > > Please provide patches for all currently supported versions. > > +1 I cannot apply cleanly to 22.11 doesn't look like we have CSRF tokens in 22.11 so i think missing dependencies anyway (In reply to Wainui Witika-Park from comment #11) > (In reply to Wainui Witika-Park from comment #10) > > (In reply to Lucas Gass (lukeg) from comment #9) > > > Please provide patches for all currently supported versions. > > > > +1 I cannot apply cleanly to 22.11 > > doesn't look like we have CSRF tokens in 22.11 so i think missing > dependencies anyway That's an interesting point. I suppose 22.11 would have quite a few CSRF vulnerabilities, so I suppose we just don't backport this one to it? Pushed to main for 26.05.00 Pushed to 25.11 for 25.11.01 Pushed to 24.11 for 24.11.12 Pushed to 22.11 for 22.11.34 Great work everyone! Also pushed to 25.05 for 25.05.07! |