Bug 40993 - Do not allow direct calls of value_builder scripts
Summary: Do not allow direct calls of value_builder scripts
Status: Signed Off
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Marcel de Rooy
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-10-10 09:42 UTC by Marcel de Rooy
Modified: 2025-11-13 09:28 UTC (History)
3 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 40993: Add Apache RewriteRule for hitting value_builder pages (1.78 KB, patch)
2025-10-10 09:59 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action (1.24 KB, patch)
2025-10-21 04:57 UTC, David Cook
Details | Diff | Splinter Review
Bug 40993: Add Apache RewriteRule for hitting value_builder pages (1.79 KB, patch)
2025-10-21 04:58 UTC, David Cook
Details | Diff | Splinter Review
Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action (1.24 KB, patch)
2025-10-21 04:58 UTC, David Cook
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Marcel de Rooy 2025-10-10 09:42:55 UTC
See 37041/40943. On 40943 we check the correct session id now. But we still should not hit those value builder pages directly and generate 500s.
But the login problem of 37041 has been addressed.
Comment 1 Marcel de Rooy 2025-10-10 09:59:10 UTC
Created attachment 187723 [details] [review]
Bug 40993: Add Apache RewriteRule for hitting value_builder pages

Test plan:
Copy this file to /etc/koha.
Restart Apache.
Login to staff and hit a value builder page directly, e.g.:
YOUR_SERVER/cgi-bin/koha/cataloguing/value_builder/marc21_field_005.pl
Verify that you got redirected to 403.
Verify that you can still edit a biblio record and open e.g. the leader
plugin form.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 2 Marcel de Rooy 2025-10-10 10:00:22 UTC
Your follow-up here would be appreciated. Thanks.
Comment 3 David Cook 2025-10-12 22:46:42 UTC
(In reply to Marcel de Rooy from comment #2)
> Your follow-up here would be appreciated. Thanks.

Catching up on my emails, but I'm adding a note to review this as soon as I can. At a glance, it looks pretty good although I think I might have a change to make.
Comment 4 David Cook 2025-10-21 04:55:18 UTC
Removing the dependency on bug 40943 because it doesn't require it to function. Moving it to See Also instead.

Before the patch, I go to http://localhost:8081/cgi-bin/koha/cataloguing/value_builder/marc21_field_005.pl and it gives me a 500

With the patch:
- sudo cp debian/templates/apache-shared-intranet.conf /etc/koha/apache-shared-intranet.conf
- sudo service apache2 restart

And that doesn't work because KTD doesn't use /etc/koha/apache-shared-intranet.conf it uses /etc/koha/apache-shared-intranet-git.conf

So I'll manually include the line into /etc/koha/apache-shared-intranet-git.conf

And that's looking good. I just have one tweak to make.
Comment 5 David Cook 2025-10-21 04:57:53 UTC Comment hidden (obsolete)
Comment 6 David Cook 2025-10-21 04:58:17 UTC
Created attachment 188186 [details] [review]
Bug 40993: Add Apache RewriteRule for hitting value_builder pages

Test plan:
Copy this file to /etc/koha.
Restart Apache.
Login to staff and hit a value builder page directly, e.g.:
YOUR_SERVER/cgi-bin/koha/cataloguing/value_builder/marc21_field_005.pl
Verify that you got redirected to 403.
Verify that you can still edit a biblio record and open e.g. the leader
plugin form.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 7 David Cook 2025-10-21 04:58:24 UTC
Created attachment 188187 [details] [review]
Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action

Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 8 Marcel de Rooy 2025-10-21 11:06:20 UTC
(In reply to David Cook from comment #7)
> Created attachment 188187 [details] [review] [review]
> Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action
> 
> Signed-off-by: David Cook <dcook@prosentient.com.au>

Ah great, thx.