<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body>A new request with request id 15967 has been created by koha-devel-request@lists.koha-community.org. Short info on the request is : <br><br>Title : Koha-devel Digest, Vol 190, Issue 3<br>Category : <br>Description : <div>Send Koha-devel mailing list submissions to<br> koha-devel@lists.koha-community.org<br><br>To subscribe or unsubscribe via the World Wide Web, visit<br> https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel<br>or, via email, send a message with subject or body 'help' to<br> koha-devel-request@lists.koha-community.org<br><br>You can reach the person managing the list at<br> koha-devel-owner@lists.koha-community.org<br><br>When replying, please edit your Subject line so it is more specific<br>than "Re: Contents of Koha-devel digest..."<br><br><br>Today's Topics:<br><br> 1. Fwd: Critical security bug in Koha! (Paul Poulain)<br> 2. Re: Fwd: Critical security bug in Koha! (Paul Poulain)<br> 3. Immediate logout in Koha 21.05.02 (03?) (Michael Kuhn)<br><br><br>----------------------------------------------------------------------<br><br>Message: 1<br>Date: Thu, 2 Sep 2021 14:18:09 +0200<br>From: Paul Poulain <paul.poulain@biblibre.com><br>To: "koha-devel@lists.koha-community.org"<br> <koha-devel@lists.koha-community.org>, SUPPORT <support@biblibre.com><br>Subject: [Koha-devel] Fwd: Critical security bug in Koha!<br>Message-ID: <a9660ef7-e0e5-866b-ccb7-561cc97da280@biblibre.com><br>Content-Type: text/plain; charset="utf-8"; Format="flowed"<br><br>Je vous fais suivre ce mail de joubu, si qqn peut se pencher dessus et <br>contribuer à le résoudre... (me tenir au courant svp)<br><br>A+<br><br><br><br>-------- Message transféré --------<br>Sujet : Critical security bug in Koha!<br>Date : Wed, 1 Sep 2021 11:34:23 +0200<br>De : Jonathan Druart <jonathan.druart@gmail.com><br>Pour : Martin Renvoize <martin.renvoize@ptfs-europe.com>, Paul Poulain <br><paul.poulain@biblibre.com>, Nick Clemens <nick@bywatersolutions.com>, <br>Tomas Cohen Arazi <tomascohen@gmail.com>, David Cook <br><dcook@prosentient.com.au>, Philippe Blouin <br><philippe.blouin@inlibro.com>, Marcel de Rooy <br><M.de.Rooy@rijksmuseum.nl>, Andrii Vashchuk <nugged@gmail.com>, Katrin <br>Fischer <Katrin.Fischer.83@web.de>, Chris Cormack <br><chris@bigballofwax.co.nz>, Galen Charlton <gmcharlt@gmail.com>, Mason <br>James <mtj@kohaaloha.com>, Owen Leonard <oleonard@myacpl.org><br><br><br><br>Hello everybody,<br><br>If you get this email I am expecting from you to talk about it to whom<br>could be concerned.<br><br>Yesterday a bug (28929) was reported about a possible privilege escalation.<br>https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28929<br>It is confirmed and is highlighly critical in some cases, and stay<br>critical in all other cases. It's really bad.<br>Basically we are missing filtering on patron's data when we create or<br>edit a patron. Which means a user can edit whichever info they want,<br>by modifying the DOM of the page.<br>And, it includes borrowers.flags (that's where it hurts really badly).<br><br>It impacts both OPAC and Staff interfaces.<br><br>What you should do:<br>1. Reduce the risks!<br>* Disable PatronSelfRegistration (!)<br>* Disable AutoApprovePatronProfileSettings (!) or you can totally<br>disable OPACPatronDetails<br>2. Make sure the staff interface is not accessible to the world<br>3. Remove old librarian accounts<br>4. Something else you have in mind? If so, please share!<br><br>Then you should (or ask your team to) help us. We will need people on<br>the bug to:<br>1. Write patches and discuss the best approach to fix the different<br>issues (there are patches already)<br>2. Test! and test! We will have to test on five different versions<br>(master+4 stables)!<br>3. QA, and *really* review, all the different versions (we really want<br>to prevent a mess publishing a fix that will introduce regressions).<br><br>We will then need to coordinate.<br>A plan (to discuss) could be:<br>1. Tell the big actors to be ready for an urgent release (This is the<br>goal of this email!)<br>2. Make the patches ready for the different versions (see the above)<br>3. Have all the packages ready, before we communicate publicly (Mason,<br>will you be available?)<br>4. Tell the people we know to upgrade (so, you, and those who are<br>aware of the problem)<br>5. Announce publicly<br><br>What do you think?<br><br>This info should not be public, but please communicate as much as you<br>can around you (people you trust of course).<br>No need to over communicate either, as we are not ready yet!<br><br>If you don't have access to the bug, just tell me (or Tomas, Katrin,<br>Martin, Nick, etc.)<br><br>Cheers,<br>Jonathan<br><br>-- <br>Paul Poulain, Associé-gérant / co-owner<br>BibLibre, Services en logiciels libres pour les bibliothèques<br>BibLibre, Open Source software and services for libraries<br><br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <http://lists.koha-community.org/pipermail/koha-devel/attachments/20210902/435de5a3/attachment-0001.htm><br><br>------------------------------<br><br>Message: 2<br>Date: Thu, 2 Sep 2021 14:52:10 +0200<br>From: Paul Poulain <paul.poulain@biblibre.com><br>To: koha-devel@lists.koha-community.org<br>Subject: Re: [Koha-devel] Fwd: Critical security bug in Koha!<br>Message-ID: <b2c06bcc-c27f-7b9e-5cde-c3a36bebe659@biblibre.com><br>Content-Type: text/plain; charset="utf-8"; Format="flowed"<br><br>yikes... merde...<br><br>this emails was intended to be forwarded to BibLibre developers, not to <br>this list :(((<br><br>Le 02/09/2021 à 14:18, Paul Poulain a écrit :<br>><br>> Je vous fais suivre ce mail de joubu, si qqn peut se pencher dessus et <br>> contribuer à le résoudre... (me tenir au courant svp)<br>><br>> A+<br>><br>><br>><br>> -------- Message transféré --------<br>> Sujet : Critical security bug in Koha!<br>> Date : Wed, 1 Sep 2021 11:34:23 +0200<br>> De : Jonathan Druart <jonathan.druart@gmail.com><br>> Pour : Martin Renvoize <martin.renvoize@ptfs-europe.com>, Paul <br>> Poulain <paul.poulain@biblibre.com>, Nick Clemens <br>> <nick@bywatersolutions.com>, Tomas Cohen Arazi <tomascohen@gmail.com>, <br>> David Cook <dcook@prosentient.com.au>, Philippe Blouin <br>> <philippe.blouin@inlibro.com>, Marcel de Rooy <br>> <M.de.Rooy@rijksmuseum.nl>, Andrii Vashchuk <nugged@gmail.com>, Katrin <br>> Fischer <Katrin.Fischer.83@web.de>, Chris Cormack <br>> <chris@bigballofwax.co.nz>, Galen Charlton <gmcharlt@gmail.com>, Mason <br>> James <mtj@kohaaloha.com>, Owen Leonard <oleonard@myacpl.org><br>><br>><br>><br>> Hello everybody,<br>><br>> If you get this email I am expecting from you to talk about it to whom<br>> could be concerned.<br>><br>> Yesterday a bug (28929) was reported about a possible privilege <br>> escalation.<br>> https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28929<br>> It is confirmed and is highlighly critical in some cases, and stay<br>> critical in all other cases. It's really bad.<br>> Basically we are missing filtering on patron's data when we create or<br>> edit a patron. Which means a user can edit whichever info they want,<br>> by modifying the DOM of the page.<br>> And, it includes borrowers.flags (that's where it hurts really badly).<br>><br>> It impacts both OPAC and Staff interfaces.<br>><br>> What you should do:<br>> 1. Reduce the risks!<br>> * Disable PatronSelfRegistration (!)<br>> * Disable AutoApprovePatronProfileSettings (!) or you can totally<br>> disable OPACPatronDetails<br>> 2. Make sure the staff interface is not accessible to the world<br>> 3. Remove old librarian accounts<br>> 4. Something else you have in mind? If so, please share!<br>><br>> Then you should (or ask your team to) help us. We will need people on<br>> the bug to:<br>> 1. Write patches and discuss the best approach to fix the different<br>> issues (there are patches already)<br>> 2. Test! and test! We will have to test on five different versions<br>> (master+4 stables)!<br>> 3. QA, and *really* review, all the different versions (we really want<br>> to prevent a mess publishing a fix that will introduce regressions).<br>><br>> We will then need to coordinate.<br>> A plan (to discuss) could be:<br>> 1. Tell the big actors to be ready for an urgent release (This is the<br>> goal of this email!)<br>> 2. Make the patches ready for the different versions (see the above)<br>> 3. Have all the packages ready, before we communicate publicly (Mason,<br>> will you be available?)<br>> 4. Tell the people we know to upgrade (so, you, and those who are<br>> aware of the problem)<br>> 5. Announce publicly<br>><br>> What do you think?<br>><br>> This info should not be public, but please communicate as much as you<br>> can around you (people you trust of course).<br>> No need to over communicate either, as we are not ready yet!<br>><br>> If you don't have access to the bug, just tell me (or Tomas, Katrin,<br>> Martin, Nick, etc.)<br>><br>> Cheers,<br>> Jonathan<br>> -- <br>> Paul Poulain, Associé-gérant / co-owner<br>> BibLibre, Services en logiciels libres pour les bibliothèques<br>> BibLibre, Open Source software and services for libraries<br>><br>> _______________________________________________<br>> Koha-devel mailing list<br>> Koha-devel@lists.koha-community.org<br>> https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel<br>> website : https://www.koha-community.org/<br>> git : https://git.koha-community.org/<br>> bugs : https://bugs.koha-community.org/<br><br>-- <br>Paul Poulain, Associé-gérant / co-owner<br>BibLibre, Services en logiciels libres pour les bibliothèques<br>BibLibre, Open Source software and services for libraries<br><br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <http://lists.koha-community.org/pipermail/koha-devel/attachments/20210902/765495e8/attachment-0001.htm><br><br>------------------------------<br><br>Message: 3<br>Date: Thu, 2 Sep 2021 15:22:19 +0200<br>From: Michael Kuhn <mik@adminkuhn.ch><br>To: Koha-devel <koha-devel@lists.koha-community.org><br>Subject: [Koha-devel] Immediate logout in Koha 21.05.02 (03?)<br>Message-ID: <3c65a800-23db-b7c0-320f-b963cea19c1d@adminkuhn.ch><br>Content-Type: text/plain; charset=utf-8; format=flowed<br><br>Hi<br><br>As written on this list on 26 August I tried to install Koha 21.05.03 <br>but after the installation Koha said the installed version was <br>"21.05.02.003". Jonathan Druart wrote this comes from<br><br> commit 8ea80995c590dad86c43df636456640d3aa84bab<br> Increment version for 21.05.03 release<br><br> -$VERSION = "21.05.02.002";<br> +$VERSION = "21.05.02.003";<br><br>Today I updated a Koha 18.11.05 database into this Koha 21.05.02.003 <br>installation. After restarting memcached I executed "sudo <br>koha-upgrade-schema instancename" - the output looked OK and ended with <br>the following lines:<br><br> Upgrade to 21.05.02.000 done [12:15:20]: Koha 21.05.02 release<br> Upgrade to 21.05.02.001 done [12:15:20]: Bug 28567 - Set to NULL empty <br>branches fields<br> Upgrade to 21.05.02.002 done [12:15:20]: Bug 28813 - Update <br>delivery_note to failure_code in message_queue<br> Upgrade to 21.05.02.003 done [12:15:20]: Bug 28872 - Update syspref <br>values from on and off to 1 and 0<br><br>It seems even if I installed Koha 21.05.03 it only upgraded to Koha <br>21.05.02.<br><br>I don't know if there is any connection but whatever, I was able to open <br>the staff client and to login - but as soon as I click on any link I'm <br>logged out immediately. I am able to login again and then advance to the <br>next link but then I'm logged out again etc ad infinitum. It is not <br>possible to change any system preference (internal server error) or <br>search for any users.<br><br>File "plack-error.log" sometimes tells me, without a timestamp:<br><br> new(): failed: query object HASH(0x555f47cfad30) does not support <br>cookie() and param() methods: Can't call method "cookie" on unblessed <br>reference at /usr/share/perl5/CGI/Session.pm line 707.<br><br>File "plack-intranet-error.log" says:<br><br> [2021/09/02 13:33:36] [WARN] Odd number of elements in anonymous hash <br>at /usr/share/koha/intranet/cgi-bin/catalogue/search.pl line 577.<br><br>Can anyone please give me a hint how to solve this problem?<br><br>Best wishes: Michael<br>--<br>Geschäftsführer · Diplombibliothekar BBS, Informatiker eidg. Fachausweis<br>Admin Kuhn GmbH · Pappelstrasse 20 · 4123 Allschwil · Schweiz<br>T 0041 (0)61 261 55 61 · E mik@adminkuhn.ch · W www.adminkuhn.ch<br><br><br>------------------------------<br><br>Subject: Digest Footer<br><br>_______________________________________________<br>Koha-devel mailing list<br>Koha-devel@lists.koha-community.org<br>https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel<br>website : https://www.koha-community.org/<br>git : https://git.koha-community.org/<br>bugs : https://bugs.koha-community.org/<br><br><br>------------------------------<br><br>End of Koha-devel Digest, Vol 190, Issue 3<br>******************************************<br></div><br><br>NOTE: You are receiving this mail because, the Requester/Technician wanted you to get notified on this request creation.<br></body></html>