Bug 18898 - Some permissions for Reports can be bypassed
Summary: Some permissions for Reports can be bypassed
Status: Pushed to Stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Reports (show other bugs)
Version: master
Hardware: All All
: P5 - low major (vote)
Assignee: David Cook
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-07-05 18:33 UTC by Michael S.
Modified: 2017-09-15 23:20 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 18898 - Some permissions for Reports can be bypassed (1.19 KB, patch)
2017-07-27 02:00 UTC, David Cook
Details | Diff | Splinter Review
Bug 18898 - Some permissions for Reports can be bypassed (1.37 KB, patch)
2017-07-28 20:01 UTC, Marc Véron
Details | Diff | Splinter Review
Bug 18898 - Some permissions for Reports can be bypassed (1.42 KB, patch)
2017-07-31 12:13 UTC, Nick Clemens
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Michael S. 2017-07-05 18:33:45 UTC
In 16.11.05.000

If a user has permissions to run - but not create or edit reports - they can still create or edit reports by editing the the URL while running a report and changing the Phase parameter to "Edit SQL" or "Create report from SQL".
Comment 1 Josef Moravec 2017-07-10 11:27:40 UTC
I could confirm that on master too, raising importance...
Comment 2 David Cook 2017-07-27 01:51:41 UTC
Doesn't surprise me. There are many parts of Koha where the permission restricts viewing a link or a button, but doesn't apply to the actual web page itself :/.
Comment 3 David Cook 2017-07-27 01:54:06 UTC
Also reproduced it. Let's see if I can fix this quickly...
Comment 4 David Cook 2017-07-27 02:00:47 UTC
Created attachment 65292 [details] [review]
Bug 18898 - Some permissions for Reports can be bypassed

If you manually visit the following links when you only have
permission to run reports, you'll still be able to access the ability
to create and edit reports:

/cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL
/cgi-bin/koha/reports/guided_reports.pl?phase=Edit%20SQL

This patch ties these 2 unaccounted for phases to the create_reports
permission.
Comment 5 Marc Véron 2017-07-28 20:01:33 UTC
Created attachment 65320 [details] [review]
Bug 18898 - Some permissions for Reports can be bypassed

If you manually visit the following links when you only have
permission to run reports, you'll still be able to access the ability
to create and edit reports:

/cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL
/cgi-bin/koha/reports/guided_reports.pl?phase=Edit%20SQL

This patch ties these 2 unaccounted for phases to the create_reports
permission.

With patch, issue no longer can be reproduced.
Signed-off-by: Marc Véron <veron@veron.ch>
Comment 6 Nick Clemens 2017-07-31 12:13:31 UTC
Created attachment 65337 [details] [review]
Bug 18898 - Some permissions for Reports can be bypassed

If you manually visit the following links when you only have
permission to run reports, you'll still be able to access the ability
to create and edit reports:

/cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL
/cgi-bin/koha/reports/guided_reports.pl?phase=Edit%20SQL

This patch ties these 2 unaccounted for phases to the create_reports
permission.

With patch, issue no longer can be reproduced.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 7 Jonathan Druart 2017-08-09 19:53:56 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 8 Fridolin SOMERS 2017-09-12 13:52:57 UTC
Pushed to 17.05.x, will be in 17.05.04.
Comment 9 Katrin Fischer 2017-09-15 23:20:39 UTC
This patch has been pushed to 16.11.x and will be in 16.11.12.