Bug 35941 - OPAC user can guess clubs of other users
Summary: OPAC user can guess clubs of other users
Status: Pushed to oldoldoldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: Main
Hardware: All All
: P5 - low critical
Assignee: Jonathan Druart
QA Contact: Martin Renvoize (ashimema)
URL:
Keywords:
Depends on: 12461
Blocks: 35942
  Show dependency treegraph
 
Reported: 2024-01-30 13:51 UTC by Jonathan Druart
Modified: 2024-07-25 11:11 UTC (History)
11 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00,23.11.03,23.05.09,22.11.15,22.05.19
Circulation function:


Attachments
Bug 35941: Limit club list to those from the logged in user (5.83 KB, patch)
2024-01-30 13:56 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 35941: Limit club list to those from the logged in user (5.89 KB, patch)
2024-01-30 14:41 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 35941: (QA follow-up) Tidy clubs-tab.pl (1.44 KB, patch)
2024-01-30 14:46 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 35941: Limit club list to those from the logged in user (5.95 KB, patch)
2024-01-31 13:50 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 35941: (QA follow-up) Tidy clubs-tab.pl (1.51 KB, patch)
2024-01-31 13:50 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2024-01-30 13:51:32 UTC

    
Comment 1 Jonathan Druart 2024-01-30 13:56:09 UTC
Created attachment 161637 [details] [review]
Bug 35941: Limit club list to those from the logged in user

clubs-tab get the patron's id from the parameter. At the OPAC we must
use the one from the logged in user, to prevent leak to other users

Test plan:
Have 2 clubs: A, B
Enroll to A with patron borrowernumber=1
Enroll to B with patron borrowernumber=2
Log in with patron 1 and hit:
  http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=1
=> OK
Now hit
  http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=2
=> oops

Apply this patch, try again.
The "borrowernumber" parameter is no longer used to fetch the club list.
Comment 2 Kyle M Hall (khall) 2024-01-30 14:41:36 UTC
Created attachment 161643 [details] [review]
Bug 35941: Limit club list to those from the logged in user

clubs-tab get the patron's id from the parameter. At the OPAC we must
use the one from the logged in user, to prevent leak to other users

Test plan:
Have 2 clubs: A, B
Enroll to A with patron borrowernumber=1
Enroll to B with patron borrowernumber=2
Log in with patron 1 and hit:
  http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=1
=> OK
Now hit
  http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=2
=> oops

Apply this patch, try again.
The "borrowernumber" parameter is no longer used to fetch the club list.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 3 Kyle M Hall (khall) 2024-01-30 14:46:00 UTC
Created attachment 161644 [details] [review]
Bug 35941: (QA follow-up) Tidy clubs-tab.pl

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 4 Martin Renvoize (ashimema) 2024-01-31 13:50:30 UTC
Created attachment 161687 [details] [review]
Bug 35941: Limit club list to those from the logged in user

clubs-tab get the patron's id from the parameter. At the OPAC we must
use the one from the logged in user, to prevent leak to other users

Test plan:
Have 2 clubs: A, B
Enroll to A with patron borrowernumber=1
Enroll to B with patron borrowernumber=2
Log in with patron 1 and hit:
  http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=1
=> OK
Now hit
  http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=2
=> oops

Apply this patch, try again.
The "borrowernumber" parameter is no longer used to fetch the club list.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 5 Martin Renvoize (ashimema) 2024-01-31 13:50:32 UTC
Created attachment 161688 [details] [review]
Bug 35941: (QA follow-up) Tidy clubs-tab.pl

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 6 Martin Renvoize (ashimema) 2024-01-31 13:51:11 UTC
No regressions found, QA scripts happy and resolves the issue.

Passing QA
Comment 7 Martin Renvoize (ashimema) 2024-02-15 09:47:10 UTC
Pushed to master for 24.05.00
Comment 8 Frédéric Demians 2024-02-22 10:37:26 UTC
Complex to backport to 22.11 due to patch 33895 which changed a lot of code. Is that bad if it's not backported?
Comment 9 Fridolin Somers 2024-03-04 10:41:55 UTC
(In reply to Frédéric Demians from comment #8)
> Complex to backport to 22.11 due to patch 33895 which changed a lot of code.
> Is that bad if it's not backported?

I see it in now in 22.11.15
Comment 10 Fridolin Somers 2024-03-04 10:43:00 UTC
@Lucas

I don't see this in 23.05.09
Comment 11 Fridolin Somers 2024-03-07 08:30:54 UTC
(In reply to Fridolin Somers from comment #10)
> @Lucas
> 
> I don't see this in 23.05.09

Will be released in v23.05.09-1