Bug 11660 - tools/pdfViewer.pl is vulnerable to displaying the contents of an arbitrary file on the server
Summary: tools/pdfViewer.pl is vulnerable to displaying the contents of an arbitrary f...
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P1 - high critical (vote)
Assignee: Galen Charlton
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-02-01 00:42 UTC by Galen Charlton
Modified: 2019-06-27 09:24 UTC (History)
0 users

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 11660 : tools/pdfViewer.pl is insecure (2.09 KB, patch)
2014-02-01 01:23 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 11660: remove disused tools/pdfViewer.pl (2.17 KB, patch)
2014-02-01 02:17 UTC, Galen Charlton
Details | Diff | Splinter Review
[PASSED QA] Bug 11660: remove disused tools/pdfViewer.pl (2.25 KB, patch)
2014-02-01 16:37 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Chris Cormack 2014-02-01 01:23:37 UTC Comment hidden (obsolete)
Comment 2 Galen Charlton 2014-02-01 02:17:26 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2014-02-01 16:37:52 UTC
Created attachment 24976 [details] [review]
[PASSED QA] Bug 11660: remove disused tools/pdfViewer.pl

tools/pdfViewer.pl can be used to read artibrary files on the system.

It is actually an unused file, so leaving it around serves no purpose
and is dangerous.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
No regressions found.
Comment 4 Galen Charlton 2014-02-07 01:41:10 UTC
Pushed to master.  Thanks, Chris!
Comment 5 Galen Charlton 2014-02-07 02:05:34 UTC
Included in the following releases: 3.8.23, 3.10.13, 3.12.10, and 3.14.3.