Bug 19881 - authorities-list.pl can be executed by anybody
Summary: authorities-list.pl can be executed by anybody
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-12-26 21:05 UTC by Jonathan Druart
Modified: 2019-10-14 19:55 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 19881: Remove authorities-list.pl (2.05 KB, patch)
2017-12-26 21:06 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 19881: Remove authorities-list.pl (2.10 KB, patch)
2017-12-26 22:26 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 19881: Remove authorities-list.pl (2.15 KB, patch)
2018-01-05 11:15 UTC, Nick Clemens
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2017-12-26 21:05:43 UTC
This script must be removed as it can be executed without permissions (!)
And... it retrieves all authorities.
I let your imagination running wild to know what it is possible to do with that script...
Comment 1 Jonathan Druart 2017-12-26 21:06:47 UTC
Created attachment 70166 [details] [review]
Bug 19881: Remove authorities-list.pl

For obvious reasons...
Comment 2 Katrin Fischer 2017-12-26 22:26:43 UTC
Created attachment 70168 [details] [review]
Bug 19881: Remove authorities-list.pl

For obvious reasons...

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 3 Nick Clemens 2018-01-05 11:15:26 UTC
Created attachment 70282 [details] [review]
Bug 19881: Remove authorities-list.pl

For obvious reasons...

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 4 Jonathan Druart 2018-02-15 19:08:06 UTC
Patch pushed to
* master for 18.05
* 17.11.x for v17.11.02
* 17.05.x for v17.05.08