Bug 11661 - edithelp.pl can be used to write arbitrary files to the server
Summary: edithelp.pl can be used to write arbitrary files to the server
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: master
Hardware: All All
: P1 - high critical (vote)
Assignee: Galen Charlton
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-02-01 00:55 UTC by Galen Charlton
Modified: 2019-06-27 09:24 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Galen Charlton 2014-02-01 00:58:30 UTC
Similarly, the 'modify' action should be checked.
Comment 4 Katrin Fischer 2014-02-02 10:36:55 UTC
I can't edit the help on my Koha because of a problem with file permissions - I am not sure how to set them correctly. It's a dev installation (not gitified). Can I get a hint?
Comment 6 Marcel de Rooy 2014-02-06 09:41:41 UTC
(In reply to Katrin Fischer from comment #4)
> I can't edit the help on my Koha because of a problem with file permissions
> - I am not sure how to set them correctly. It's a dev installation (not
> gitified). Can I get a hint?

Katrin
To get it to write to /tmp, I had to count the number of directories upward and add a few ..-s in order to get to the root of the server and than to /tmp.
Could that be your problem?
Comment 8 Galen Charlton 2014-02-07 01:42:04 UTC
Pushed to master.  Thanks, Chris!
Comment 9 Galen Charlton 2014-02-07 02:05:43 UTC
Included in the following releases: 3.8.23, 3.10.13, 3.12.10, and 3.14.3.