From bugzilla-daemon@bugs.koha-community.org Wed Mar 19 04:24:33 2025
From: bugzilla-daemon@bugs.koha-community.org
To: koha-bugs@lists.koha-community.org
Subject: [Koha-bugs] [Bug 39375] New: About page accessible to low privileged
 staff users
Date: Wed, 19 Mar 2025 03:24:33 +0000
Message-ID: <bug-39375-70@https.bugs.koha-community.org/bugzilla3/>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============7720073349148045712=="

--===============7720073349148045712==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39375

            Bug ID: 39375
           Summary: About page accessible to low privileged staff users
 Change sponsored?: ---
           Product: Koha
           Version: Main
          Hardware: All
                OS: All
            Status: NEW
          Severity: minor
          Priority: P5 - low
         Component: About
          Assignee: koha-bugs@lists.koha-community.org
          Reporter: dcook@prosentient.com.au
        QA Contact: testopia@bugs.koha-community.org

At the moment, anyone with staff interface access can visit the About page at
about.pl. 

There's privileged information available via that interface

--

This is something we seem to acknowledge in
koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt:

<p class="problem ret_datacorrupt">The item has not been checked in due to a
configuration issue in your system. You must ask an administ
rator to take a look at the <a
href="/cgi-bin/koha/about.pl#sysinfo_panel">about page</a> and correct all
errors shown on the "System information" tab</p>

That said, koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt says
<div class="dialog message">ILL module configuration problem. Take a look at
the <a href="/cgi-bin/koha/about.pl#sysinfo_panel">about page</a></div>

So we should probably update ill-requests.tt to match returns.tt

-- 
You are receiving this mail because:
You are watching all bug changes.
You are the assignee for the bug.

--===============7720073349148045712==--


From bugzilla-daemon@bugs.koha-community.org Wed Mar 19 04:26:58 2025
From: bugzilla-daemon@bugs.koha-community.org
To: koha-bugs@lists.koha-community.org
Subject:
 [Koha-bugs] [Bug 39375] About page accessible to low privileged staff users
Date: Wed, 19 Mar 2025 03:26:58 +0000
Message-ID: <bug-39375-70-Ylayxbi1z0@https.bugs.koha-community.org/bugzilla3/>
In-Reply-To: <bug-39375-70@https.bugs.koha-community.org/bugzilla3/>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2981863960323141112=="

--===============2981863960323141112==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39375

--- Comment #1 from David Cook <dcook@prosentient.com.au> ---
Alternatively, we could - at a minimum - hide "Server information", "Perl
modules", and "System information" from unprivileged staff users.

-- 
You are receiving this mail because:
You are watching all bug changes.
You are the assignee for the bug.

--===============2981863960323141112==--


From bugzilla-daemon@bugs.koha-community.org Wed Mar 19 09:57:10 2025
From: bugzilla-daemon@bugs.koha-community.org
To: koha-bugs@lists.koha-community.org
Subject:
 [Koha-bugs] [Bug 39375] About page accessible to low privileged staff users
Date: Wed, 19 Mar 2025 08:57:09 +0000
Message-ID: <bug-39375-70-rjgnLcZzHA@https.bugs.koha-community.org/bugzilla3/>
In-Reply-To: <bug-39375-70@https.bugs.koha-community.org/bugzilla3/>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2022628371352991267=="

--===============2022628371352991267==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39375

--- Comment #2 from Katrin Fischer <katrin.fischer@bsz-bw.de> ---
If we hid System information that is where the link from circulation links
to...

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.

--===============2022628371352991267==--


From bugzilla-daemon@bugs.koha-community.org Thu Mar 20 00:39:09 2025
From: bugzilla-daemon@bugs.koha-community.org
To: koha-bugs@lists.koha-community.org
Subject:
 [Koha-bugs] [Bug 39375] About page accessible to low privileged staff users
Date: Wed, 19 Mar 2025 23:39:08 +0000
Message-ID: <bug-39375-70-uDwjFW8hiZ@https.bugs.koha-community.org/bugzilla3/>
In-Reply-To: <bug-39375-70@https.bugs.koha-community.org/bugzilla3/>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============9155952575715455082=="

--===============9155952575715455082==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39375

--- Comment #3 from David Cook <dcook@prosentient.com.au> ---
(In reply to Katrin Fischer from comment #2)
> If we hid System information that is where the link from circulation links
> to...

Yes, but it says "You must ask an administrator to take a look at the about
page and correct..."

So that would be OK

-- 
You are receiving this mail because:
You are watching all bug changes.
You are the assignee for the bug.

--===============9155952575715455082==--