Bug 29542 - User with 'catalogue' permission can view everybody's (private) virtualshelves
Summary: User with 'catalogue' permission can view everybody's (private) virtualshelves
Status: Pushed to oldoldoldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: master
Hardware: All All
: P5 - low normal (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-11-20 20:01 UTC by Joonas Kylmälä
Modified: 2022-02-08 00:36 UTC (History)
14 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.05.00,21.11.02,21.05.09,20.11.14,19.11.25


Attachments
Bug 29542: Check permission to view list in sendshelf (1.35 KB, patch)
2021-11-22 07:44 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 29542: Prevent access to private list to non authorized users (2.73 KB, patch)
2022-01-05 14:58 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 29542: Prevent access to private list to non authorized users (2.79 KB, patch)
2022-01-06 18:19 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 29542: Prevent access to private list to non authorized users (2.84 KB, patch)
2022-01-12 12:21 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Joonas Kylmälä 2021-11-20 20:01:12 UTC
Any user with just 'catalogue' permission can view everybody's virtualshelves lists by sending them to their wanted email address by just going to this URL:

localhost:8081/cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XXX

Gladly the borrower's details are not included in that but however the list name is, and that might contain some private information relating to the patron, e.g. maybe they named the list after their own name "John's favorite books"
Comment 1 Marcel de Rooy 2021-11-22 07:44:03 UTC
Created attachment 127914 [details] [review]
Bug 29542: Check permission to view list in sendshelf

Test plan:
Find a (private) list that you should not be able to view.
Try the URL /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=[list_number]
You should see an error message. (Which could surely be improved on
another report.)

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 2 Marcel de Rooy 2021-12-22 14:37:10 UTC
Triggering more attention for this bug by changing status ;)
Comment 3 Katrin Fischer 2022-01-02 16:00:22 UTC
I am not sure about the solution here, because now you still get to see the email form, the error only appears after you tried to send the list.

Could we prevent showing the form and show the error right away?
Comment 4 Jonathan Druart 2022-01-05 14:58:32 UTC
Created attachment 129030 [details] [review]
Bug 29542: Prevent access to private list to non authorized users

The catalogue permission is not enough.

Test plan:
Create a private list owned by user A
Login with user B and hit (with XX the shelfid)
  /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX

You should get an error message "You do not have sufficient permission
to continue."

Login with user A
=> You should be able to send the list
Comment 5 Jonathan Druart 2022-01-05 14:59:34 UTC
We can early exit at the top of the script and use output_and_exit && blocking_error.inc
Comment 6 Katrin Fischer 2022-01-06 18:19:27 UTC
Created attachment 129108 [details] [review]
Bug 29542: Prevent access to private list to non authorized users

The catalogue permission is not enough.

Test plan:
Create a private list owned by user A
Login with user B and hit (with XX the shelfid)
  /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX

You should get an error message "You do not have sufficient permission
to continue."

Login with user A
=> You should be able to send the list

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 7 Tomás Cohen Arazi 2022-01-12 12:21:47 UTC
Created attachment 129335 [details] [review]
Bug 29542: Prevent access to private list to non authorized users

The catalogue permission is not enough.

Test plan:
Create a private list owned by user A
Login with user B and hit (with XX the shelfid)
  /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX

You should get an error message "You do not have sufficient permission
to continue."

Login with user A
=> You should be able to send the list

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 8 Victor Grousset/tuxayo 2022-01-27 20:52:02 UTC
Backported: Pushed to 20.11.x-security branch for 20.11.14
Comment 9 Andrew Fuerste-Henry 2022-01-28 14:20:02 UTC
Pushed to security/21.05.x for 21.05.09
Comment 10 wainuiwitikapark 2022-01-30 23:36:07 UTC
Backported to 19.11.x-security branch on the Security repo for 19.11.25 security release.