gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/opac
History
Jonathan Druart dd93d0c662 Bug 16593: Do not allow patrons to delete search history of others patrons 
A malicious user can delete the search history of all other users by
correctly guessing the ID value assigned to the victim's search. As
searches are assigned values sequentially, an attacker could quickly
remove the searches belonging to all of the application's users.

To reproduce:
Login with patron A
launch a search
Note the id generated for this search history:
select id from search_history order by id desc limit 1;
Login with patron B
Hit /cgi-bin/koha/opac-search-history.pl?action=delete&id=<ID>
Note that the row is deleted in the DB

Test plan
Confirm that this patch fixes the issue.
The same test can be made at the staff interface

Reported by Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
 		2016-08-04 08:26:58 +12:00
..
errors Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
rss adding file just for creating the rss directory 2007-08-02 08:50:43 +00:00
sco Bug 14298: Use the new permission in the sco scripts 2015-09-23 06:07:21 +12:00
svc Bug 13758: Move the Koha version from kohaversion.pl 2015-05-07 11:39:04 -03:00
ilsdi.pl Bug 16476: Do not call CGI->param in list context, some more 2016-08-04 08:19:20 +12:00
maintenance.pl Bug 13758: Move the Koha version from kohaversion.pl 2015-05-07 11:39:04 -03:00
oai.pl Bug 15946 Valid namespace for OAI marcxml schema (3.22/3.20) 2016-03-23 13:50:56 +01:00
opac-ISBDdetail.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-MARCdetail.pl Bug 15382: 245$a visibility constraints not respected in opac-MARCdetail.pl 2015-12-31 18:39:28 +01:00
opac-account.pl Bug 15344: Remove some other calls of GetMemberDetails from pl scripts 2015-12-31 18:13:01 +01:00
opac-addbybiblionumber.pl Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off 2016-02-20 08:39:19 +01:00
opac-alert-subscribe.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-authorities-home.pl Bug 14076: Do not use CGI->param in list context - opac-authorities-home.pl 2016-04-27 16:38:45 +02:00
opac-authoritiesdetail.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-basket.pl Bug 5371: Force no caching for private pages at the OPAC 2015-12-04 20:24:56 +01:00
opac-blocked.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
opac-browser.pl Bug 5371: Force no caching for private pages at the OPAC 2015-12-04 20:24:56 +01:00
opac-changelanguage.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-course-details.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-course-reserves.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-detail.pl Bug 14496: Improving opac-detail.pl performances 2015-07-15 08:53:20 +12:00
opac-discharge.pl Bug 5371: Force no caching for private pages at the OPAC 2015-12-04 20:24:56 +01:00
opac-downloadcart.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-downloadshelf.pl Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off 2016-02-20 08:39:19 +01:00
opac-export.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-ics.pl Bug 15344: Remove some other calls of GetMemberDetails from pl scripts 2015-12-31 18:13:01 +01:00
opac-idref.pl Bug 8992: Interfacing with the Idref webservice 2015-04-28 15:46:26 -03:00
opac-image.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-imageviewer.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-main.pl Bug 15613: Fix 2 other occurrences of paramter vs parameter 2016-02-11 20:07:25 +01:00
opac-memberentry.pl Bug 5371: Force no caching for private pages at the OPAC 2015-12-04 20:24:56 +01:00
opac-messaging.pl Bug 15344: Remove some other calls of GetMemberDetails from pl scripts 2015-12-31 18:13:01 +01:00
opac-modrequest-suspend.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-modrequest.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-mymessages.pl Bug 5371: Force no caching for private pages at the OPAC 2015-12-04 20:24:56 +01:00
opac-news-rss.pl Bug 7843: (QA followup) Make news selection persistant 2015-04-30 16:33:21 -03:00
opac-overdrive-search.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
opac-passwd.pl Bug 15344: Remove some other calls of GetMemberDetails from pl scripts 2015-12-31 18:13:01 +01:00
opac-patron-image.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-privacy.pl Bug 15344: Remove some other calls of GetMemberDetails from pl scripts 2015-12-31 18:13:01 +01:00
opac-ratings-ajax.pl Bug 14553: Silencing warn triggered when clearing item rating on OPAC 2015-11-29 21:55:24 +01:00
opac-ratings.pl Bug 16179: Do not crash if "rate me" is clicked and not rate selected 2016-04-27 17:02:34 +02:00
opac-readingrecord.pl Bug 5371: (follow-up) Force no caching for private pages at the OPAC 2015-12-04 20:25:22 +01:00
opac-registration-verify.pl Bug 11693: Default emailing preferences not loaded for self registering patron 2015-08-10 09:33:36 +12:00
opac-renew.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-reserve.pl Bug 15375 [QA Followup] - Fix non-functional restriction message and date 2016-02-11 20:10:58 +01:00
opac-review.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-search-history.pl Bug 16593: Do not allow patrons to delete search history of others patrons 2016-08-04 08:26:58 +12:00
opac-search.pl Bug 15818 - OPAC search with utf-8 characters and without results generates encoding error 2016-03-01 14:39:44 +01:00
opac-sendbasket.pl Bug 14330: Remove unused email_sender from sendbasket/sendshelf 2015-06-09 08:38:40 +12:00
opac-sendshelf.pl Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off 2016-02-20 08:39:19 +01:00
opac-serial-issues.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-shareshelf.pl Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off 2016-02-20 08:39:19 +01:00
opac-shelves.pl Bug 6322 - It's possible to view lists/virtualshelves even when virtualshelves is off 2016-02-20 08:39:19 +01:00
opac-showmarc.pl Bug 11944: use CGI( -utf8 ) everywhere 2015-01-13 13:07:21 -03:00
opac-showreviews.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-suggestions.pl Bug 15035: Anti-spam for opac-suggestions - FOLLOW-UP 2015-11-29 21:32:18 +01:00
opac-tags.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-tags_subject.pl Bug 14412: SQL injection possible 2015-06-23 10:11:53 +12:00
opac-topissues.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
opac-user.pl Bug 14930 [QA Followup] - Allow OpacFineNoRenewals to be 0 2016-03-01 14:51:17 +01:00
tracklinks.pl Bug 9978: Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:38 -03:00
unapi Bug 15190: Bad utf8 decode to unapi and fixing status code 200 2016-02-11 20:09:55 +01:00