gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 16593: Do not allow patrons to delete search history of others patrons 

A malicious user can delete the search history of all other users by
correctly guessing the ID value assigned to the victim's search. As
searches are assigned values sequentially, an attacker could quickly
remove the searches belonging to all of the application's users.

To reproduce:
Login with patron A
launch a search
Note the id generated for this search history:
select id from search_history order by id desc limit 1;
Login with patron B
Hit /cgi-bin/koha/opac-search-history.pl?action=delete&id=<ID>
Note that the row is deleted in the DB

Test plan
Confirm that this patch fixes the issue.
The same test can be made at the staff interface

Reported by Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This commit is contained in:
Jonathan Druart 2016-05-26 11:52:19 +01:00 committed by Kyle M Hall
parent 33f1354b7b
commit f01720808a
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
catalogue/search-history.pl
View File

@ -46,7 +46,8 @@ if ( $action eq 'delete' ) {
: q{};
C4::Search::History::delete(
{
id => [ $cgi->param('id') ],
userid => $loggedinuser,
id => [ $cgi->param('id') ],
}
);
# Redirecting to this same url so the user won't see the search history link in the header

3
opac/opac-search-history.pl
View File

@ -103,7 +103,8 @@ unless ( $loggedinuser ) {
if ( @id ) {
C4::Search::History::delete(
{
id => [ $cgi->param('id') ],
userid => $loggedinuser,
id => [ $cgi->param('id') ],
}
);
} else {