Bug 40993 - Do not allow direct calls of value_builder scripts
Summary: Do not allow direct calls of value_builder scripts
Status: Needs Signoff
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Marcel de Rooy
QA Contact: Testopia
URL:
Keywords:
Depends on: 40943
Blocks:
  Show dependency treegraph
 
Reported: 2025-10-10 09:42 UTC by Marcel de Rooy
Modified: 2025-10-10 10:00 UTC (History)
2 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 40993: Add Apache RewriteRule for hitting value_builder pages (1.78 KB, patch)
2025-10-10 09:59 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2025-10-10 09:42:55 UTC
See 37041/40943. On 40943 we check the correct session id now. But we still should not hit those value builder pages directly and generate 500s.
But the login problem of 37041 has been addressed.
Comment 1 Marcel de Rooy 2025-10-10 09:59:10 UTC
Created attachment 187723 [details] [review]
Bug 40993: Add Apache RewriteRule for hitting value_builder pages

Test plan:
Copy this file to /etc/koha.
Restart Apache.
Login to staff and hit a value builder page directly, e.g.:
YOUR_SERVER/cgi-bin/koha/cataloguing/value_builder/marc21_field_005.pl
Verify that you got redirected to 403.
Verify that you can still edit a biblio record and open e.g. the leader
plugin form.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 2 Marcel de Rooy 2025-10-10 10:00:22 UTC
Your follow-up here would be appreciated. Thanks.