From 244e798a514bebaa3928a81f195d7612f75d03c5 Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Mon, 24 Jan 2022 10:24:08 +0000 Subject: [PATCH 1/4] Bug 29931: Check cookie status before continuing Test plan: Logout from staff. Try to run plugins-enable (you should have some active plugin). Like: https://yourserver:staffport/cgi-bin/koha/plugins/plugins-enable.pl?class=Koha::Plugin::Test&method=enable Replace class and method as appropriate. Verify that with this patch, you will be redirected to 401 page. Signed-off-by: Marcel de Rooy Signed-off-by: Jonathan Druart Signed-off-by: Jonathan Druart Signed-off-by: Kyle M Hall --- plugins/plugins-enable.pl | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/plugins/plugins-enable.pl b/plugins/plugins-enable.pl index 146fae96ad..79cd88af88 100755 --- a/plugins/plugins-enable.pl +++ b/plugins/plugins-enable.pl @@ -27,8 +27,11 @@ die("Koha plugins are disabled!") unless C4::Context->config("enable_plugins"); my $input = CGI->new; -my ( $auth_status ) = - check_cookie_auth( $input->cookie('CGISESSID'), { plugins => 'manage' } ); +my ( $auth_status ) = check_cookie_auth( $input->cookie('CGISESSID'), { plugins => 'manage' } ); +if( $auth_status ne 'ok' ) { + print CGI::header( '-status' => '401' ); + exit 0; +} my $class = $input->param('class'); my $method = $input->param('method'); From c93df0695f7963538689c8091dcd64e2186ce2c9 Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Mon, 24 Jan 2022 13:06:33 +0000 Subject: [PATCH 2/4] Bug 29931: (follow-up) Similar thing in opac-patron-image.pl Although less harmful indeed. No borrowernumber, no image. Signed-off-by: Marcel de Rooy Tested: logged in, logged out, prefs toggled. All fine. Signed-off-by: Jonathan Druart Signed-off-by: Kyle M Hall --- opac/opac-patron-image.pl | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/opac/opac-patron-image.pl b/opac/opac-patron-image.pl index df1efdf4ef..dccba229eb 100755 --- a/opac/opac-patron-image.pl +++ b/opac/opac-patron-image.pl @@ -32,13 +32,14 @@ unless (C4::Context->preference('OPACpatronimages')) { exit; } -my $needed_flags; -my %cookies = CGI::Cookie->fetch; -my $sessid = $cookies{'CGISESSID'}->value; -my ($auth_status) = check_cookie_auth($sessid, $needed_flags); -my $borrowernumber = C4::Context->userenv->{'number'}; +my ($auth_status) = check_cookie_auth( $query->cookie('CGISESSID') ); +if( $auth_status ne 'ok' ) { + print CGI::header( '-status' => '401' ); + exit 0; +} -my $patron_image = Koha::Patron::Images->find($borrowernumber); +my $userenv = C4::Context->userenv; +my $patron_image = $userenv ? Koha::Patron::Images->find( $userenv->{number} ) : undef; if ($patron_image) { print $query->header( From 8b91d08faedc00fffc9e88c36c58a6f7a61f411b Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Tue, 25 Jan 2022 12:21:42 +0000 Subject: [PATCH 3/4] Bug 29931: (follow-up) Fix svc/checkouts and return_claims too Adding the same auth_status check here too. Signed-off-by: Marcel de Rooy Signed-off-by: Jonathan Druart Signed-off-by: Kyle M Hall --- svc/checkouts | 7 +++++-- svc/return_claims | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/svc/checkouts b/svc/checkouts index 30bbee53b1..096d953d1f 100755 --- a/svc/checkouts +++ b/svc/checkouts @@ -33,8 +33,11 @@ use Koha::ItemTypes; my $input = CGI->new; -my ( $auth_status, $session ) = - check_cookie_auth( $input->cookie('CGISESSID')); +my ( $auth_status, $session ) = check_cookie_auth( $input->cookie('CGISESSID')); +if( $auth_status ne 'ok' ) { + print CGI::header( '-status' => '401' ); + exit 0; +} my $userid = $session->param('id'); diff --git a/svc/return_claims b/svc/return_claims index 5ac7d49e79..726b756f83 100755 --- a/svc/return_claims +++ b/svc/return_claims @@ -31,8 +31,11 @@ use Koha::Patrons; my $input = CGI->new; -my ( $auth_status, $session ) = - check_cookie_auth( $input->cookie('CGISESSID') ); +my ( $auth_status, $session ) = check_cookie_auth( $input->cookie('CGISESSID') ); +if( $auth_status ne 'ok' ) { + print CGI::header( '-status' => '401' ); + exit 0; +} my $userid = $session->param('id'); From 2a4fa92458369b3b6689ad2d468752fceec8d2ec Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Thu, 27 Jan 2022 14:14:27 +0100 Subject: [PATCH 4/4] Bug 29956: Prevent login form to be serialized into cookie To recrate: Logout Go to /cgi-bin/koha/opac-search.pl Click "Log in to your account" Fill in the login form Submit Check the 'form_serialized' cookie's value => Without this patch it contain login/password => With this patch applied the cookie is not created Confirm that the "Return to the last advanced search" feature still works as expected. Signed-off-by: Nick Clemens Signed-off-by: Marcel de Rooy Signed-off-by: Kyle M Hall --- koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt index b4ac896084..1d7f0d9f36 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt @@ -9,7 +9,7 @@ [% INCLUDE 'bodytag.inc' bodyid='advsearch' bodyclass='scrollto' %] [% INCLUDE 'masthead.inc' %] -
+