gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/opac
History
Jonathan Druart eb991bfcf9 Bug 16593: Do not allow patrons to delete search history of others patrons 
A malicious user can delete the search history of all other users by
correctly guessing the ID value assigned to the victim's search. As
searches are assigned values sequentially, an attacker could quickly
remove the searches belonging to all of the application's users.

To reproduce:
Login with patron A
launch a search
Note the id generated for this search history:
select id from search_history order by id desc limit 1;
Login with patron B
Hit /cgi-bin/koha/opac-search-history.pl?action=delete&id=<ID>
Note that the row is deleted in the DB

Test plan
Confirm that this patch fixes the issue.
The same test can be made at the staff interface

Reported by Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit f01720808a)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
(cherry picked from commit 0974bb3888)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
 		2016-08-16 14:22:08 +02:00
..
errors Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
rss
…
sco Bug 12663 - SCOUserCSS and SCOUserJS ignored on selfcheck login page 2016-05-09 10:39:17 +02:00
svc Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-16 11:37:09 +02:00
ilsdi.pl Bug 16476: Do not call CGI->param in list context, some more 2016-05-16 19:16:03 +02:00
maintenance.pl Bug 13758: Move the Koha version from kohaversion.pl 2015-05-07 11:39:04 -03:00
oai.pl Bug 15946 Valid namespace for OAI marcxml schema (3.22/3.20) 2016-03-23 09:56:12 +01:00
opac-ISBDdetail.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-MARCdetail.pl Bug 15382: 245$a visibility constraints not respected in opac-MARCdetail.pl 2015-12-31 14:03:23 +01:00
opac-account.pl Bug 15344: Remove some other calls of GetMemberDetails from pl scripts 2015-12-31 10:29:16 +01:00
opac-addbybiblionumber.pl Bug 16518: Fix Plack variable scoping problem in opac-addbybiblionumber.pl 2016-06-16 10:27:30 +02:00
opac-alert-subscribe.pl Bug 14956: C4::Dates from files opac/*.pl 2015-11-06 15:01:28 -03:00
opac-authorities-home.pl Bug 14076: Do not use CGI->param in list context - opac-authorities-home.pl 2016-04-08 07:42:12 +02:00
opac-authoritiesdetail.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-basket.pl Bug 5371: Force no caching for private pages at the OPAC 2015-10-02 11:06:17 -03:00
opac-blocked.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
opac-browser.pl Bug 5371: Force no caching for private pages at the OPAC 2015-10-02 11:06:17 -03:00
opac-changelanguage.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-course-details.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-course-reserves.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-detail.pl Bug 16041: Turn off StaffAuthorisedValueImages by default 2016-05-16 09:30:32 +02:00
opac-discharge.pl Bug 15823: Redirect opac-discharge.pl to 404 page 2016-05-16 09:23:13 +02:00
opac-downloadcart.pl Bug 14544: Get rid of C4::VirtualShelves and C4::VirtualShelves::Page 2015-11-05 09:58:02 -03:00
opac-downloadshelf.pl Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off 2016-02-04 22:22:29 +01:00
opac-export.pl Bug 16578: Fix wide character errors in opac-export.pl 2016-06-16 10:44:32 +02:00
opac-ics.pl Bug 15344: Remove some other calls of GetMemberDetails from pl scripts 2015-12-31 10:29:16 +01:00
opac-idref.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-16 11:37:09 +02:00
opac-image.pl Bug 16154: CGI->multi_param - Manual changes 2016-05-16 14:38:57 +02:00
opac-imageviewer.pl Bug 7976: Remove the borrow permission 2015-06-05 13:43:34 -03:00
opac-main.pl Bug 15613: Fix 2 other occurrences of paramter vs parameter 2016-01-29 15:59:43 +01:00
opac-memberentry.pl Bug 14956: (followup) Fix birthday date validation in Opac 2015-11-06 15:01:37 -03:00
opac-messaging.pl Bug 15344: Remove some other calls of GetMemberDetails from pl scripts 2015-12-31 10:29:16 +01:00
opac-modrequest-suspend.pl Bug 7976: Remove the borrow permission 2015-06-05 13:43:34 -03:00
opac-modrequest.pl Bug 7976: Remove the borrow permission 2015-06-05 13:43:34 -03:00
opac-mymessages.pl Bug 5371: Force no caching for private pages at the OPAC 2015-10-02 11:06:17 -03:00
opac-news-rss.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-16 11:37:09 +02:00
opac-overdrive-search.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
opac-passwd.pl Bug 15344: Remove some other calls of GetMemberDetails from pl scripts 2015-12-31 10:29:16 +01:00
opac-patron-image.pl Bug 14589: Adjust authorities_merge_ajax and replace some indirect syntax 2015-11-02 12:49:13 -03:00
opac-privacy.pl Bug 15344: Remove some other calls of GetMemberDetails from pl scripts 2015-12-31 10:29:16 +01:00
opac-ratings-ajax.pl Bug 14553: Silencing warn triggered when clearing item rating on OPAC 2015-11-11 11:08:50 -03:00
opac-ratings.pl Bug 16179: Do not crash if "rate me" is clicked and not rate selected 2016-04-21 10:14:07 +02:00
opac-readingrecord.pl Bug 14100: Fix 3 occurrences more 2015-10-27 12:34:07 -03:00
opac-registration-verify.pl Bug 11693: Default emailing preferences not loaded for self registering patron 2015-07-24 13:44:39 -03:00
opac-renew.pl Bug 16154: CGI->multi_param - Declare a list 2016-05-16 14:38:51 +02:00
opac-reserve.pl Bug 15375 [QA Followup] - Fix non-functional restriction message and date 2016-01-29 16:06:33 +01:00
opac-restrictedpage.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-16 11:37:09 +02:00
opac-retrieve-file.pl Bug 14321: Integrate Upload.pm into Koha 2015-09-25 12:02:52 -03:00
opac-review.pl Bug 16154: CGI->multi_param - Force scalar context 2016-05-16 14:42:43 +02:00
opac-search-history.pl Bug 16593: Do not allow patrons to delete search history of others patrons 2016-08-16 14:22:08 +02:00
opac-search.pl Bug 16154: CGI->multi_param - Assign a list 2016-05-16 14:42:51 +02:00
opac-sendbasket.pl Bug 14330: Remove unused email_sender from sendbasket/sendshelf 2015-06-08 10:38:08 -03:00
opac-sendshelf.pl Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off 2016-02-04 22:22:29 +01:00
opac-serial-issues.pl Bug 16154: CGI->multi_param - Force scalar context 2016-05-16 14:42:43 +02:00
opac-shareshelf.pl Bug 16317 - Attempt to share private list results in error 2016-04-25 14:15:51 +02:00
opac-shelves.pl Bug 16154: CGI->multi_param - Force scalar context 2016-05-16 14:42:43 +02:00
opac-showmarc.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
opac-showreviews.pl Bug 14956: C4::Dates from files opac/*.pl 2015-11-06 15:01:28 -03:00
opac-suggestions.pl Bug 16154: CGI->multi_param - Declare a list 2016-05-16 14:38:51 +02:00
opac-tags.pl Bug 14589: Adjust authorities_merge_ajax and replace some indirect syntax 2015-11-02 12:49:13 -03:00
opac-tags_subject.pl Bug 14412: SQL injection possible 2015-06-22 11:00:10 -03:00
opac-topissues.pl Bug 16154: CGI->multi_param - Force scalar context 2016-05-16 14:42:43 +02:00
opac-user.pl Bug 16154: CGI->multi_param - Force scalar context 2016-05-16 14:42:43 +02:00
tracklinks.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
unapi Bug 15190: Bad utf8 decode to unapi and fixing status code 200 2016-01-29 16:05:11 +01:00