gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/opac
History
Jonathan Druart 0974bb3888 Bug 16593: Do not allow patrons to delete search history of others patrons 
A malicious user can delete the search history of all other users by
correctly guessing the ID value assigned to the victim's search. As
searches are assigned values sequentially, an attacker could quickly
remove the searches belonging to all of the application's users.

To reproduce:
Login with patron A
launch a search
Note the id generated for this search history:
select id from search_history order by id desc limit 1;
Login with patron B
Hit /cgi-bin/koha/opac-search-history.pl?action=delete&id=<ID>
Note that the row is deleted in the DB

Test plan
Confirm that this patch fixes the issue.
The same test can be made at the staff interface

Reported by Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit f01720808a)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
 		2016-08-01 08:53:51 +02:00
..
errors Bug 15288: Error pages: Code duplication removal and better translatability 2016-01-27 05:57:34 +00:00
rss
…
sco Bug 12663 - SCOUserCSS and SCOUserJS ignored on selfcheck login page 2016-04-22 00:57:44 +00:00
svc Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
ilsdi.pl Bug 16476: Do not call CGI->param in list context, some more 2016-05-16 17:11:46 +00:00
maintenance.pl Bug 13758: Move the Koha version from kohaversion.pl 2015-05-07 11:39:04 -03:00
oai.pl Bug 14939: Modularize OAI Server existing classes 2015-12-31 15:15:05 +00:00
opac-ISBDdetail.pl Bug 16169: Change prototype for C4::Biblio::TransformMarcToKoha 2016-04-07 00:04:21 +00:00
opac-MARCdetail.pl Bug 5979 : OPAC : using OPACISBD systempreference to display link 2016-04-22 03:14:21 +00:00
opac-account-pay-paypal-return.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
opac-account-pay.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
opac-account.pl Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
opac-addbybiblionumber.pl Bug 16518: Fix Plack variable scoping problem in opac-addbybiblionumber.pl 2016-06-15 08:15:54 +02:00
opac-alert-subscribe.pl Bug 14956: C4::Dates from files opac/*.pl 2015-11-06 15:01:28 -03:00
opac-authorities-home.pl Bug 12478: allow more granular sorting configuration 2016-04-26 20:20:08 +00:00
opac-authoritiesdetail.pl Bug 15550: Fix authority search and detail at the OPAC 2016-01-23 18:34:06 +00:00
opac-basket.pl Bug 5371: Force no caching for private pages at the OPAC 2015-10-02 11:06:17 -03:00
opac-blocked.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
opac-browser.pl Bug 5371: Force no caching for private pages at the OPAC 2015-10-02 11:06:17 -03:00
opac-changelanguage.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-course-details.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-course-reserves.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-detail.pl Bug 15263: (QA followup) Use the new XSLTParse4Display everywhere 2016-05-04 13:40:35 +00:00
opac-discharge.pl Bug 15823: Redirect opac-discharge.pl to 404 page 2016-05-06 04:20:48 +00:00
opac-downloadcart.pl Bug 14544: Get rid of C4::VirtualShelves and C4::VirtualShelves::Page 2015-11-05 09:58:02 -03:00
opac-downloadshelf.pl Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off 2016-01-27 02:31:42 +00:00
opac-export.pl Bug 16578: Fix wide character errors in opac-export.pl 2016-06-15 08:23:20 +02:00
opac-ics.pl Bug 15344: Remove some other calls of GetMemberDetails from pl scripts 2015-12-30 11:53:18 +00:00
opac-idref.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
opac-image.pl Bug 16154: CGI->multi_param - Manual changes 2016-04-26 23:16:43 +00:00
opac-imageviewer.pl Bug 7976: Remove the borrow permission 2015-06-05 13:43:34 -03:00
opac-main.pl Bug 14305: View arbitrary branch's news 2016-04-29 12:44:08 +00:00
opac-memberentry.pl Bug 16283 - Make OPAC registration captcha case insensitive 2016-04-29 11:55:07 +00:00
opac-messaging.pl Bug 12528: redirect to 404 if at least 1 pref is off 2016-04-29 17:54:10 +00:00
opac-modrequest-suspend.pl Bug 7976: Remove the borrow permission 2015-06-05 13:43:34 -03:00
opac-modrequest.pl Bug 7976: Remove the borrow permission 2015-06-05 13:43:34 -03:00
opac-mymessages.pl Bug 5371: Force no caching for private pages at the OPAC 2015-10-02 11:06:17 -03:00
opac-news-rss.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
opac-overdrive-search.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
opac-passwd.pl Bug 15344: Remove some other calls of GetMemberDetails from pl scripts 2015-12-30 11:53:18 +00:00
opac-password-recovery.pl Bug 15585 - Move C4::Passwordrecovery to the new namespace Koha::Patron::Password::Reset 2016-03-22 23:08:21 +00:00
opac-patron-image.pl Bug 15635: Koha::Patron::Images - Remove GetPatronImage 2016-03-04 12:54:15 +00:00
opac-privacy.pl Bug 15548: Move new patron related code to Patron* 2016-03-03 14:38:26 -07:00
opac-ratings-ajax.pl Bug 14553: Silencing warn triggered when clearing item rating on OPAC 2015-11-11 11:08:50 -03:00
opac-ratings.pl Bug 16179: Do not crash if "rate me" is clicked and not rate selected 2016-04-20 19:50:00 +00:00
opac-readingrecord.pl Bug 14100: Fix 3 occurrences more 2015-10-27 12:34:07 -03:00
opac-registration-verify.pl Bug 15548: Move new patron related code to Patron* 2016-03-03 14:38:26 -07:00
opac-renew.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
opac-reserve.pl Bug 15533 [QA Followup] - All itemtypes for all items showing in OPAC multi-hold 2016-04-29 10:26:05 +00:00
opac-restrictedpage.pl Bug 16447: Remove occurrence of the borrow permission which does no longer exist 2016-05-05 21:28:14 +00:00
opac-retrieve-file.pl Bug 14321: Integrate Upload.pm into Koha 2015-09-25 12:02:52 -03:00
opac-review.pl Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
opac-search-history.pl Bug 16593: Do not allow patrons to delete search history of others patrons 2016-08-01 08:53:51 +02:00
opac-search.pl Bug 16154: CGI->multi_param - Assign a list 2016-04-26 23:16:43 +00:00
opac-sendbasket.pl Bug 14306: Show URL from MARC21 field 555$u under Title Notes/Descriptions 2016-03-07 17:58:32 +00:00
opac-sendshelf.pl Bug 14306: Remove call to GetMarcNotes from sendshelf 2016-03-07 17:58:33 +00:00
opac-serial-issues.pl Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
opac-shareshelf.pl Bug 16317 - Attempt to share private list results in error 2016-04-22 22:47:34 +00:00
opac-shelves.pl Bug 15263: (QA followup) Make *shelves.pl use the new API 2016-05-04 13:40:35 +00:00
opac-showmarc.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
opac-showreviews.pl Bug 14956: C4::Dates from files opac/*.pl 2015-11-06 15:01:28 -03:00
opac-suggestions.pl Bug 16154: CGI->multi_param - Declare a list 2016-04-26 23:16:42 +00:00
opac-tags.pl Bug 15263: (QA followup) Use the new XSLTParse4Display everywhere 2016-05-04 13:40:35 +00:00
opac-tags_subject.pl Bug 14412: SQL injection possible 2015-06-22 11:00:10 -03:00
opac-topissues.pl Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
opac-user.pl Bug 16154: CGI->multi_param - Force scalar context 2016-04-26 23:16:43 +00:00
tracklinks.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
unapi Bug 15162 Add for Unimarc XSL trans for RDF-DC & SRW-DC 2016-01-27 06:00:35 +00:00