Bug 40993 - Do not allow direct calls of value_builder scripts
Summary: Do not allow direct calls of value_builder scripts
Status: Pushed to main
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Marcel de Rooy
QA Contact: Testopia
URL:
Keywords: release-notes-needed
Depends on:
Blocks:
 
Reported: 2025-10-10 09:42 UTC by Marcel de Rooy
Modified: 2026-01-13 17:14 UTC (History)
4 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
26.05.00
Circulation function:


Attachments
Bug 40993: Add Apache RewriteRule for hitting value_builder pages (1.78 KB, patch)
2025-10-10 09:59 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action (1.24 KB, patch)
2025-10-21 04:57 UTC, David Cook
Details | Diff | Splinter Review
Bug 40993: Add Apache RewriteRule for hitting value_builder pages (1.79 KB, patch)
2025-10-21 04:58 UTC, David Cook
Details | Diff | Splinter Review
Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action (1.24 KB, patch)
2025-10-21 04:58 UTC, David Cook
Details | Diff | Splinter Review
Bug 40993: Add Apache RewriteRule for hitting value_builder pages (1.60 KB, patch)
2025-12-08 12:28 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action (1.31 KB, patch)
2025-12-08 12:28 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 40993: (follow-up) Add changes to etc/koha-httpd.conf (1.08 KB, patch)
2026-01-13 15:56 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 40993: Update etc/koha-httpd.conf (981 bytes, patch)
2026-01-13 16:00 UTC, Lucas Gass (lukeg)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2025-10-10 09:42:55 UTC
See 37041/40943. On 40943 we check the correct session id now. But we still should not hit those value builder pages directly and generate 500s.
But the login problem of 37041 has been addressed.
Comment 1 Marcel de Rooy 2025-10-10 09:59:10 UTC
Created attachment 187723 [details] [review]
Bug 40993: Add Apache RewriteRule for hitting value_builder pages

Test plan:
Copy this file to /etc/koha.
Restart Apache.
Login to staff and hit a value builder page directly, e.g.:
YOUR_SERVER/cgi-bin/koha/cataloguing/value_builder/marc21_field_005.pl
Verify that you got redirected to 403.
Verify that you can still edit a biblio record and open e.g. the leader
plugin form.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 2 Marcel de Rooy 2025-10-10 10:00:22 UTC
Your follow-up here would be appreciated. Thanks.
Comment 3 David Cook 2025-10-12 22:46:42 UTC
(In reply to Marcel de Rooy from comment #2)
> Your follow-up here would be appreciated. Thanks.

Catching up on my emails, but I'm adding a note to review this as soon as I can. At a glance, it looks pretty good although I think I might have a change to make.
Comment 4 David Cook 2025-10-21 04:55:18 UTC
Removing the dependency on bug 40943 because it doesn't require it to function. Moving it to See Also instead.

Before the patch, I go to http://localhost:8081/cgi-bin/koha/cataloguing/value_builder/marc21_field_005.pl and it gives me a 500

With the patch:
- sudo cp debian/templates/apache-shared-intranet.conf /etc/koha/apache-shared-intranet.conf
- sudo service apache2 restart

And that doesn't work because KTD doesn't use /etc/koha/apache-shared-intranet.conf it uses /etc/koha/apache-shared-intranet-git.conf

So I'll manually include the line into /etc/koha/apache-shared-intranet-git.conf

And that's looking good. I just have one tweak to make.
Comment 5 David Cook 2025-10-21 04:57:53 UTC Comment hidden (obsolete)
Comment 6 David Cook 2025-10-21 04:58:17 UTC
Created attachment 188186 [details] [review]
Bug 40993: Add Apache RewriteRule for hitting value_builder pages

Test plan:
Copy this file to /etc/koha.
Restart Apache.
Login to staff and hit a value builder page directly, e.g.:
YOUR_SERVER/cgi-bin/koha/cataloguing/value_builder/marc21_field_005.pl
Verify that you got redirected to 403.
Verify that you can still edit a biblio record and open e.g. the leader
plugin form.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 7 David Cook 2025-10-21 04:58:24 UTC
Created attachment 188187 [details] [review]
Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action

Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 8 Marcel de Rooy 2025-10-21 11:06:20 UTC
(In reply to David Cook from comment #7)
> Created attachment 188187 [details] [review] [review]
> Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action
> 
> Signed-off-by: David Cook <dcook@prosentient.com.au>

Ah great, thx.
Comment 9 Martin Renvoize (ashimema) 2025-12-08 12:28:40 UTC
Created attachment 190284 [details] [review]
Bug 40993: Add Apache RewriteRule for hitting value_builder pages

Test plan:
Copy this file to /etc/koha.
Restart Apache.
Login to staff and hit a value builder page directly, e.g.:
YOUR_SERVER/cgi-bin/koha/cataloguing/value_builder/marc21_field_005.pl
Verify that you got redirected to 403.
Verify that you can still edit a biblio record and open e.g. the leader
plugin form.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Comment 10 Martin Renvoize (ashimema) 2025-12-08 12:28:41 UTC
Created attachment 190285 [details] [review]
Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Comment 11 Lucas Gass (lukeg) 2026-01-12 17:55:50 UTC
Nice work everyone!

Pushed to main for 26.05
Comment 12 Lucas Gass (lukeg) 2026-01-12 22:04:20 UTC
Tests are failing here now: ( xt/check_apache_conf.t )

# Subtest: Intranet RewriteRule statements
    1..1
    not ok 1 - All RewriteRule and RewriteCond directives must be copied to etc/koha-httpd.conf

    #   Failed test 'All RewriteRule and RewriteCond directives must be copied to etc/koha-httpd.conf'
    #   at /kohadevbox/koha/xt/check_apache_conf.t line 46.
    #          got: '1'
    #     expected: '0'
    # RewriteRule ^/cgi-bin/koha/cataloguing/value_builder/ /cgi-bin/koha/errors/403.pl [L,PT]
    # Looks like you failed 1 test of 1.
not ok 1 - Intranet RewriteRule statements
Comment 13 Marcel de Rooy 2026-01-13 14:55:34 UTC
Will have a look
Comment 14 Marcel de Rooy 2026-01-13 15:56:28 UTC
Created attachment 191367 [details] [review]
Bug 40993: (follow-up) Add changes to etc/koha-httpd.conf

Good to have a test :)

Test plan:
Run xt/check_apache_conf.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 15 Lucas Gass (lukeg) 2026-01-13 16:00:22 UTC
Created attachment 191368 [details] [review]
Bug 40993: Update etc/koha-httpd.conf
Comment 16 Lucas Gass (lukeg) 2026-01-13 17:14:33 UTC
follow-up pushed to main