Bug 23872 - ManaKB Permissions can be subverted
Summary: ManaKB Permissions can be subverted
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Mana-kb (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Bugs List
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-10-22 12:50 UTC by Martin Renvoize
Modified: 2019-11-12 15:13 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize 2019-10-22 12:50:55 UTC
Granular permissions for managing Mana-KB preferences were added with bug 22198 but access to those system preferences via the standard preferences page was not locked down.. 

As such, we have a hole in the permissions logic here.
Comment 1 Jonathan Druart 2019-10-24 14:27:40 UTC
Can you detail? I do not get it.
Comment 2 Martin Renvoize 2019-10-24 14:39:13 UTC
Test plan

1) Add a new user with 'manage_sysprefs' permission.
2) Note that this user can change Mana related sytem preferences via `Home › Administration › System preferences > Web services > Mana KB` regardless of whether that also have the `manage_mana` permission or not.

Note: This is actually the same case for HEA prefs too.
Comment 3 Jonathan Druart 2019-10-24 15:48:05 UTC
Do we really need this specific permission?
I would go for removing manage_mana and use manage_sysprefs instead. Or, if we really need it, add a warning in the pref's description.