Bug 39375 - About page accessible to low privileged staff users
Summary: About page accessible to low privileged staff users
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: About (show other bugs)
Version: Main
Hardware: All All
: P5 - low minor
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-03-19 03:24 UTC by David Cook
Modified: 2025-03-19 23:39 UTC (History)
0 users

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2025-03-19 03:24:33 UTC
At the moment, anyone with staff interface access can visit the About page at about.pl. 

There's privileged information available via that interface

--

This is something we seem to acknowledge in koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt:

<p class="problem ret_datacorrupt">The item has not been checked in due to a configuration issue in your system. You must ask an administ
rator to take a look at the <a href="/cgi-bin/koha/about.pl#sysinfo_panel">about page</a> and correct all errors shown on the "System information" tab</p>

That said, koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt says <div class="dialog message">ILL module configuration problem. Take a look at the <a href="/cgi-bin/koha/about.pl#sysinfo_panel">about page</a></div>

So we should probably update ill-requests.tt to match returns.tt
Comment 1 David Cook 2025-03-19 03:26:58 UTC
Alternatively, we could - at a minimum - hide "Server information", "Perl modules", and "System information" from unprivileged staff users.
Comment 2 Katrin Fischer 2025-03-19 08:57:09 UTC
If we hid System information that is where the link from circulation links to...
Comment 3 David Cook 2025-03-19 23:39:08 UTC
(In reply to Katrin Fischer from comment #2)
> If we hid System information that is where the link from circulation links
> to...

Yes, but it says "You must ask an administrator to take a look at the about page and correct..."

So that would be OK