Any user with just 'catalogue' permission can view everybody's virtualshelves lists by sending them to their wanted email address by just going to this URL: localhost:8081/cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XXX Gladly the borrower's details are not included in that but however the list name is, and that might contain some private information relating to the patron, e.g. maybe they named the list after their own name "John's favorite books"
Created attachment 127914 [details] [review] Bug 29542: Check permission to view list in sendshelf Test plan: Find a (private) list that you should not be able to view. Try the URL /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=[list_number] You should see an error message. (Which could surely be improved on another report.) Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Triggering more attention for this bug by changing status ;)
I am not sure about the solution here, because now you still get to see the email form, the error only appears after you tried to send the list. Could we prevent showing the form and show the error right away?
Created attachment 129030 [details] [review] Bug 29542: Prevent access to private list to non authorized users The catalogue permission is not enough. Test plan: Create a private list owned by user A Login with user B and hit (with XX the shelfid) /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX You should get an error message "You do not have sufficient permission to continue." Login with user A => You should be able to send the list
We can early exit at the top of the script and use output_and_exit && blocking_error.inc
Created attachment 129108 [details] [review] Bug 29542: Prevent access to private list to non authorized users The catalogue permission is not enough. Test plan: Create a private list owned by user A Login with user B and hit (with XX the shelfid) /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX You should get an error message "You do not have sufficient permission to continue." Login with user A => You should be able to send the list Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 129335 [details] [review] Bug 29542: Prevent access to private list to non authorized users The catalogue permission is not enough. Test plan: Create a private list owned by user A Login with user B and hit (with XX the shelfid) /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX You should get an error message "You do not have sufficient permission to continue." Login with user A => You should be able to send the list Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Backported: Pushed to 20.11.x-security branch for 20.11.14
Pushed to security/21.05.x for 21.05.09
Backported to 19.11.x-security branch on the Security repo for 19.11.25 security release.