June 2012 - Koha-bugs - lists.koha-community.org

[Bug 3280] opac/opac-sendbasket.pl security leaky
by bugzilla-daemon＠bugs.koha-community.org 28 Jun '12

28 Jun '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3280 Frère Sébastien Marie <semarie-koha(a)latrappe.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #10027|0 |1 is obsolete| | --- Comment #13 from Frère Sébastien Marie <semarie-koha(a)latrappe.fr> --- Created attachment 10547 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=10547&action=edit Bug 3280 Restrict Send basket feature I was add a Reply-To field to email sended. So user receiving basket known who send it. The From field keep 'KohaAdminEmailAddress'. So it should not have spam problem (if KohaAdminEmailAddress is configured appropriately) as noted by M. de Rooy. Thanks from (past and future) comments. -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

1 0

[Bug 3280] opac/opac-sendbasket.pl security leaky
by bugzilla-daemon＠bugs.koha-community.org 28 Jun '12

28 Jun '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3280 --- Comment #12 from Frère Sébastien Marie <semarie-koha(a)latrappe.fr> --- (En réponse au commentaire 11) > (En réponse au commentaire 10) > > One question remains: It works for me. But if you change the From address to > > the patron's address, could we have Relay Access Denied errors or similar? A > > mail server could reject outgoing mail if not sent from designated domains? > > Yes, it is possible that mail will be reported as spam, if the patron > address use SPF (spam prevention system based on whitelist of smtp > authorised to send email for particuliar domain). So it is possible to remove using GetFirstValidEmailAddress($borrowernumber) as >From address, and inconditionnally use C4::Context->preference('KohaAdminEmailAddress'). But I think we should include *in the body* the name/address of the sender: "This mail was sent to you from $user->{firstname} $user->{surname} <$user_email>" So authentificated user will not abuse sending email using opac-sendbasket.pl We could also add a Reply-To field with "$user->{firstname} $user->{surname} <$user_email>" ? (in order to prevent error like press the reply-to button and mail to KohaAdminEmailAddress instead of $user_email) -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

1 0

[Bug 3280] opac/opac-sendbasket.pl security leaky
by bugzilla-daemon＠bugs.koha-community.org 28 Jun '12

28 Jun '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3280 --- Comment #11 from Frère Sébastien Marie <semarie-koha(a)latrappe.fr> --- (En réponse au commentaire 10) > One question remains: It works for me. But if you change the From address to > the patron's address, could we have Relay Access Denied errors or similar? A > mail server could reject outgoing mail if not sent from designated domains? Yes, it is possible that mail will be reported as spam, if the patron address use SPF (spam prevention system based on whitelist of smtp authorised to send email for particuliar domain). -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

1 0

[Bug 3280] opac/opac-sendbasket.pl security leaky
by bugzilla-daemon＠bugs.koha-community.org 28 Jun '12

28 Jun '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3280 --- Comment #10 from M. de Rooy <m.de.rooy(a)rijksmuseum.nl> --- OK. The patch came from Frere Sebastien Marie. And current master does not allow anynomous users here (anymore). One question remains: It works for me. But if you change the From address to the patron's address, could we have Relay Access Denied errors or similar? A mail server could reject outgoing mail if not sent from designated domains? -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

1 0

[Bug 3280] opac/opac-sendbasket.pl security leaky
by bugzilla-daemon＠bugs.koha-community.org 28 Jun '12

28 Jun '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3280 M. de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=4274 -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

1 0

[Bug 4274] Cart now requires login before emailing contents
by bugzilla-daemon＠bugs.koha-community.org 28 Jun '12

28 Jun '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=4274 M. de Rooy <m.de.rooy(a)rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy(a)rijksmuseum.nl See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=3280 -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

1 0

[Bug 3280] opac/opac-sendbasket.pl security leaky
by bugzilla-daemon＠bugs.koha-community.org 28 Jun '12

28 Jun '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3280 --- Comment #9 from M. de Rooy <m.de.rooy(a)rijksmuseum.nl> --- (In reply to comment #8) > Perhaps it changed again? :( I tested on 3.6.3. No, it is not possible. Somehow I cannot reproduce anymore what I did before.. -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

1 0

[Bug 3280] opac/opac-sendbasket.pl security leaky
by bugzilla-daemon＠bugs.koha-community.org 28 Jun '12

28 Jun '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3280 --- Comment #8 from Katrin Fischer <katrin.fischer(a)bsz-bw.de> --- Perhaps it changed again? :( I tested on 3.6.3. -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

1 0

[Bug 3280] opac/opac-sendbasket.pl security leaky
by bugzilla-daemon＠bugs.koha-community.org 28 Jun '12

28 Jun '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3280 --- Comment #7 from M. de Rooy <m.de.rooy(a)rijksmuseum.nl> --- (In reply to comment #6) > Hi Marcel, not sure that was Kyle - there is bug 4274 for the problem. It > used to be possible for not logged in users to mail the cart (I know it was > in 3.2.x). Then it got changed some time after that. Now it requires you to > log in before you can send items from the cart. It is still possible in master. I just did ?? -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

1 0

[Bug 3280] opac/opac-sendbasket.pl security leaky
by bugzilla-daemon＠bugs.koha-community.org 28 Jun '12

28 Jun '12

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=3280 Katrin Fischer <katrin.fischer(a)bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer(a)bsz-bw.de --- Comment #6 from Katrin Fischer <katrin.fischer(a)bsz-bw.de> --- Hi Marcel, not sure that was Kyle - there is bug 4274 for the problem. It used to be possible for not logged in users to mail the cart (I know it was in 3.2.x). Then it got changed some time after that. Now it requires you to log in before you can send items from the cart. -- You are receiving this mail because: You are the QA Contact for the bug. You are watching all bug changes.

1 0