Bug 34306 - Update spine label tool to use more appropriate permissions
Summary: Update spine label tool to use more appropriate permissions
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Tools (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-07-18 18:55 UTC by Christopher Brannon
Modified: 2023-07-20 07:13 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Christopher Brannon 2023-07-18 18:55:24 UTC
In an attempt to work around bug 34288 until it is available to 22.11, I was checking to see if going straight to /cgi-bin/koha/labels/spinelabel-home.pl would be a reasonable workaround.  Indeed, it does work, but it works for anyone that can get to the link, not just people that have permission to the tool.  It does not seem that this tool is managed by the label_creator permission.

Then I thought, maybe this permission only manages /cgi-bin/koha/labels/label-home.pl, so I tested that.  But nope.  I can bypass permissions and get to that page.  Aren't permissions supposed to prevent you from getting to the tools at all?  Anyone can easily share urls to pages.  If all the permissions are doing is allowing a tool link to show, that is not much of a permission.  I'm a bit concerned about this.
Comment 1 Katrin Fischer 2023-07-18 21:38:04 UTC
There are 2 levels of checks: 
* In the templates, to be able to hide links and such 
* In the .pl files for allowing or not to access the page

This should not be a general problem.

The permissions for the label home page are set quite low, this can be discussed. Currently it's catalogue:

https://git.koha-community.org/Koha-community/Koha/src/branch/master/labels/label-home.pl#L34

I am not sure why that is, but it could be changed to labels I think. Also for the other pages.

Other tools have the expected stricter permissions, like notices and slips:

https://git.koha-community.org/Koha-community/Koha/src/branch/master/tools/letter.pl#L84
Comment 2 Christopher Brannon 2023-07-18 22:48:49 UTC
I think it would be a good idea to remain stricter in general.  Because this page is not as strict, I am unable to post the link to these tools on the tools page temporarily to get around the issue on bug 34288.  We should try to be consistent with the permissions.  Unless someone can think of a good reason not to do so.
Comment 3 David Cook 2023-07-19 05:08:05 UTC
The title for this bug is misleading.

There isn't anonymous access to /cgi-bin/koha/labels/spinelabel-home.pl. That page does require permission to access it.

It looks like a case where it uses the "catalogue" permission when perhaps it could use the "tools > label_creator" subpermission instead.

That said, changing the permission now could cause many staff to no longer be able to create spine labels after upgrading to a patched version. 

Since they're spine labels and not borrower information, I don't think it's too concerning. 

Perhaps a case could be made for requiring either "editcatalogue" or "tools > label_creator". Since spinelabel-home.pl is now accessible via Cataloguing rather than Tools, it might make sense to put it under the cataloguing permission.
Comment 4 David Cook 2023-07-19 05:11:40 UTC
(In reply to David Cook from comment #3)
> Perhaps a case could be made for requiring either "editcatalogue" or "tools
> > label_creator". Since spinelabel-home.pl is now accessible via Cataloguing
> rather than Tools, it might make sense to put it under the cataloguing
> permission.

After reviewing bug 34288 that actually certainly looks like the path forward.

I'm going to update the title to reflect that.
Comment 5 Christopher Brannon 2023-07-19 14:44:52 UTC
I disagree with the direction this is going.  I do not necessarily want people that need to use the spine label tools to have access to other cataloging tools.  If you change the permission altogether, you are changing how people use these tools.  I would rather the permission label_creator permission remained the permission to this tool.  If it is to remain on the cataloging menu, which makes sense, it should:
1) make the cataloging link to the page, and the cataloging page available
2) only control whether the label tools are available on the cataloging page
3) not give access to other cataloging tools
4) should not allow access to the tools like it does by going straight to their urls.

David, you stated "There isn't anonymous access to /cgi-bin/koha/labels/spinelabel-home.pl. That page does require permission to access it."

I cannot confirm your statement.  I've tested this against a patron that does not have the label_creator permission, and she was able to access both tools.  Another library also confirmed this.  Please tell me where we are missing this.  Is there another permission that might be allowing access to these tools somehow?
Comment 6 David Cook 2023-07-19 23:21:03 UTC
(In reply to Christopher Brannon from comment #5)
> David, you stated "There isn't anonymous access to
> /cgi-bin/koha/labels/spinelabel-home.pl. That page does require permission
> to access it."
> 
> I cannot confirm your statement.  I've tested this against a patron that
> does not have the label_creator permission, and she was able to access both
> tools.  Another library also confirmed this.  Please tell me where we are
> missing this.  Is there another permission that might be allowing access to
> these tools somehow?

"Anonymous access" means unauthenticated access. That is, anyone on the Internet trying to access it. The original title made it sound like anyone could access the tool just by visiting the URL, which isn't the case.

Currently, "/cgi-bin/koha/labels/spinelabel-home.pl" requires the "catalogue" permission. Counterintuitively, the "catalogue" permission is the permission that generally provides access to the staff interface. That's why any of your authenticated staff users with staff interface permission will be able to view and use that tool.

It doesn't have serious security implications, but it is suboptimal.

(In reply to Christopher Brannon from comment #5)
> I would rather the permission label_creator
> permission remained the permission to this tool.

It's not currently the permission for this tool. That's why I talked about changing it to that permission.
Comment 7 Katrin Fischer 2023-07-20 07:13:00 UTC
(In reply to Katrin Fischer from comment #1)
> There are 2 levels of checks: 
> * In the templates, to be able to hide links and such 
> * In the .pl files for allowing or not to access the page
> 
> This should not be a general problem.
> 
> The permissions for the label home page are set quite low, this can be
> discussed. Currently it's catalogue:
> 
> https://git.koha-community.org/Koha-community/Koha/src/branch/master/labels/
> label-home.pl#L34
> 
> I am not sure why that is, but it could be changed to labels I think. Also
> for the other pages.
> 
> Other tools have the expected stricter permissions, like notices and slips:
> 
> https://git.koha-community.org/Koha-community/Koha/src/branch/master/tools/
> letter.pl#L84

I did explain which permission exactly in the first comment... just saying. "catalogue".