Bug 19881 - authorities-list.pl can be executed by anybody
Summary: authorities-list.pl can be executed by anybody
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-12-26 21:05 UTC by Jonathan Druart
Modified: 2019-10-14 19:55 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Bug 19881: Remove authorities-list.pl (2.05 KB, patch)
2017-12-26 21:06 UTC, Jonathan Druart 		Details | Diff | Splinter Review
Bug 19881: Remove authorities-list.pl (2.10 KB, patch)
2017-12-26 22:26 UTC, Katrin Fischer 		Details | Diff | Splinter Review
Bug 19881: Remove authorities-list.pl (2.15 KB, patch)
2018-01-05 11:15 UTC, Nick Clemens (kidclamp) 		Details | Diff | Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2017-12-26 21:05:43 UTC 
This script must be removed as it can be executed without permissions (!)
And... it retrieves all authorities.
I let your imagination running wild to know what it is possible to do with that script...
Comment 1 Jonathan Druart 2017-12-26 21:06:47 UTC 
Created attachment 70166 [details] [review]
Bug 19881: Remove authorities-list.pl

For obvious reasons...
Comment 2 Katrin Fischer 2017-12-26 22:26:43 UTC 
Created attachment 70168 [details] [review]
Bug 19881: Remove authorities-list.pl

For obvious reasons...

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 3 Nick Clemens (kidclamp) 2018-01-05 11:15:26 UTC 
Created attachment 70282 [details] [review]
Bug 19881: Remove authorities-list.pl

For obvious reasons...

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 4 Jonathan Druart 2018-02-15 19:08:06 UTC 
Patch pushed to
* master for 18.05
* 17.11.x for v17.11.02
* 17.05.x for v17.05.08