If you're an authenticated OPAC user, you can craft requests to opac-dismiss-message.pl to update the "patron_read_date" for any message for any user. Note this won't work for an anonymous/unauthenticated user.
Created attachment 164450 [details] [review] Bug 36532: Protect opac-dismiss-message.pl from malicious usages Really bad design, NEVER retrieve the logged in user from the CGI param! See comment 1 for more info
Created attachment 164484 [details] [review] Bug 36532: Protect opac-dismiss-message.pl from malicious usages Really bad design, NEVER retrieve the logged in user from the CGI param! See comment 1 for more info Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Created attachment 164526 [details] [review] Bug 36532: Protect opac-dismiss-message.pl from malicious usages Really bad design, NEVER retrieve the logged in user from the CGI param! See comment 1 for more info Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: David Cook <dcook@prosentient.com.au>
Great job, Jonathan. Thanks for taking care of this one.
Applied to 22.05.x-security
I am getting the following error on jenkins: "xt_find_cud_t.This branch is not supposed to have 'cud-', see bug 34478. (2034)" https://jenkins.koha-community.org/job/Koha_Sec/job/Koha_22.05/lastCompletedBuild/testReport/(root)/xt_find_cud_t/This_branch_is_not_supposed_to_have__cud____see_bug_34478___2034_/ I ran the prove xt/find-cud.t and got the following output: kohadev-koha@kohadevbox:koha((9733fdbbcbf...))$ prove xt/find-cud.t xt/find-cud.t .. 1/1 # Failed test 'This branch is not supposed to have 'cud-', see bug 34478.' # at xt/find-cud.t line 25. # got: '2' # expected: '0' # $VAR1 = [ # 'koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc: <input type="hidden" name="op" value="cud-update" />', # 'opac/opac-routing-lists.pl:unless ( $op =~ /^cud-/ && $message ) {' # ]; # Looks like you failed 1 test of 1. xt/find-cud.t .. Dubious, test returned 1 (wstat 256, 0x100) Failed 1/1 subtests Test Summary Report ------------------- xt/find-cud.t (Wstat: 256 (exited 1) Tests: 1 Failed: 1) Failed test: 1 Non-zero exit status: 1 Files=1, Tests=1, 0 wallclock secs ( 0.01 usr 0.01 sys + 0.09 cusr 0.20 csys = 0.31 CPU) Result: FAIL Which says there is something wrong with the following files - koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-note.inc - opac/opac-routing-lists.pl And those files were changed in this bug - and have added "cud-" Is there a way that I can fix this failing test?
Oh I am also getting the following error which also seems to be related to this bug https://jenkins.koha-community.org/job/Koha_Sec/job/Koha_22.05/lastCompletedBuild/testReport/(root)/t_db_dependent_00_strict_t/Syntax_check_opac_opac_routing_lists_pl__1798_/ Please help :)
(In reply to wainuiwitikapark from comment #8) > Oh I am also getting the following error which also seems to be related to > this bug > https://jenkins.koha-community.org/job/Koha_Sec/job/Koha_22.05/ > lastCompletedBuild/testReport/(root)/t_db_dependent_00_strict_t/ > Syntax_check_opac_opac_routing_lists_pl__1798_/ > > Please help :) I think you can just revert as the base feature doesn't exist in 22.05
This doesn't apply because the dependency https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12029 isn't in 22.05
(In reply to wainuiwitikapark from comment #6) > Applied to 22.05.x-security Reverted this out of 22.05
Pushed for 24.05! Well done everyone, thank you!
Arg, I see it is in 22.11.x but depends on Bug 12029 only since 23.05 https://git.koha-community.org/Koha-community/Koha/commit/2278d229e899cd279f62addd8275365718ad8cbb
I've done a message to @fredericdemians in chat
(In reply to Fridolin Somers from comment #14) > I've done a message to @fredericdemians in chat Seeing that it was reverted in 22.11.x