- Koha-bugs - lists.koha-community.org

[Bug 28957] Many plugins require the full plugins permission set to run
by bugzilla-daemon＠bugs.koha-community.org 21 Jul '25

21 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28957 --- Comment #10 from David Cook <dcook(a)prosentient.com.au> --- Lastly... my one concern about letting plugins manage their own permissions is that I suspect that they just will allow anyone to do anything. I don't think I've ever reviewed a Koha Plugin that didn't have some kind of security vulnerability in it. Although usually it's SQL injection. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 28957] Many plugins require the full plugins permission set to run
by bugzilla-daemon＠bugs.koha-community.org 21 Jul '25

21 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28957 --- Comment #9 from David Cook <dcook(a)prosentient.com.au> --- (In reply to David Cook from comment #8) > We're stuck in a tricky place. If we want to fix the security, we might have > to break some plugins. Or... We add a system preference. Something like "PluginsStrictPermissions", which requires run.pl to only work with methods "report", "tool", "admin", or "configure". Most plugins should be fitting in this paradigm. For plugins that aren't... they have to disable "PluginsStrictPermissions" and there they read a warning saying they need to either align their permissions with "report", "tool", "admin", or "configure" OR use this new "koha_authz" Koha plugin class method so that they handle permissions on their own. Maybe we start with "ExperimentalPluginsStrictPermissions" and default it to "off" or "warn" where "warn" would generates some warnings (maybe just in the logs) saying that the plugin is using an unconventional method for run.pl. And then in a release or two we change "ExperimentalPluginsStrictPermissions" to "PluginsStrictPermissions" and default it to "on" so people are forced to turn it off or update their plugins. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 28957] Many plugins require the full plugins permission set to run
by bugzilla-daemon＠bugs.koha-community.org 21 Jul '25

21 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28957 --- Comment #8 from David Cook <dcook(a)prosentient.com.au> --- Ok, I have an idea germinating. We change ./plugins/run.pl so that flagsrequired => { catalogue => 1 }. This means that anyone with staff interface access can execute this staff interface Perl script. We wrap Koha::Plugins::Handler->run() with a "C4::Auth::haspermission()" check. We take care of our existing known use cases of "report", "tool", "admin", and "configure" which are pre-existing "plugins" subpermissions. If a method is not "report", "tool", "admin", or "configure", then we need to do something else. This is the use case mentioned by Martin here. And historically these users have required full plugins permissions to run the plugin. So some options coming to mind: 1. We interpret any other method as requiring a "report", "tool", or "admin" permission. In some ways it would make things more secure (ie these people wouldn't need full/configure permissions in order to run the plugins), but in other ways it would be less secure because now anyone could run weird plugin methods if they have any of the 'report', 'tool', or 'admin'. Not very optimal... 2. We add a new plugin class method called "koha_authz". If $class->can('koha_authz'), we try to delegate authorization to the plugin. If it doesn't have that class method, then we fallback to the status quo of requiring full "plugins" permissions? Yet, this is still a problem as I noted before. People with full plugins permission have access to too many plugin methods... -- We're stuck in a tricky place. If we want to fix the security, we might have to break some plugins. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 28957] Many plugins require the full plugins permission set to run
by bugzilla-daemon＠bugs.koha-community.org 21 Jul '25

21 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28957 --- Comment #7 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Fridolin Somers from comment #3) > Should we change for only one subpermission "run plugin" ? > And plugins have to implement permissions. Thinking about this logically... what are we actually trying to accomplish? "Run plugin" sounds good to a developer, but it doesn't really make sense in terms of the user story. If a person is using a reports plugin, what they really need are reports permissions. If they're using a tools plugin, they need tools permissions. Admin plugin - admin permissions. I'm not familiar with the "Online Payments plugin" or the "CLA Permissions Check plugin", but it sounds like they exist beyond this existing framework. And it does sound like they really need to handle their own permissions. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 28957] Many plugins require the full plugins permission set to run
by bugzilla-daemon＠bugs.koha-community.org 21 Jul '25

21 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28957 --- Comment #6 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Martin Renvoize (ashimema) from comment #0) > Some plugins with hooks into the UI outside of the tools and plugin > management page require the overall 'plugins' permission to run. > > This however has the side effect of allowing users with those permissions to > also manage plugins which may not be the effect wanted. > > Example: A site has both an Online Payments plugin and the CLA Permissions > Check plugin installed. To use the button from the catalogueing toolbar for > the CLA plugin you are required to have the overall plugins permission. This > then exposes the login credentials for the Online payments plugin as the > user gets access to the tools pages. Ah right so "configure" needs to be separate from "run" for sure. But I think "report", "tool", and "admin" might all be synonymous with "run"? Although I'm guessing that people have used them to limit people to plugins in particular areas of Koha... Tricky. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 28957] Many plugins require the full plugins permission set to run
by bugzilla-daemon＠bugs.koha-community.org 21 Jul '25

21 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28957 --- Comment #5 from David Cook <dcook(a)prosentient.com.au> --- (In reply to Fridolin Somers from comment #3) > Indeed the permissions are on the plugin method : > https://git.koha-community.org/Koha-community/Koha/src/commit/ > ac02c1d2adc883cc6ff6b749c271cb165d337436/plugins/run.pl#L40 > > But currently only exists tool and report > and plugins create there own methods. These days, there are permissions for these methods: "report", "tool", "admin", or "configure" > Should we change for only one subpermission "run plugin" ? > And plugins have to implement permissions. That could be difficult to apply retroactively, but might not be a bad idea. I've been thinking a bit about "permission policies" which could be applied at different levels (like the borrower as user/subject or the plugin as object/resource). It could be an opportunity to experiment with the idea. The idea being Koha core would have the code like "Koha::Authz::authorize($user,$action,$resource). I haven't fully thought out the design, but the idea would be that there's a permission policy attached to that Koha plugin $resource and it says whether a particular user or categorycode (or whatever) is allowed to do $action against it. That "run plugin" could be the minimum level of permission that a user needs in order to run "run.pl" at all, and then permission policies could kick in from there. For backwards compatibility, we'd probably need to let "report", "tool", "admin" have "run_plugin". Not sure about "configure". -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 28957] Many plugins require the full plugins permission set to run
by bugzilla-daemon＠bugs.koha-community.org 21 Jul '25

21 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28957 David Cook <dcook(a)prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook(a)prosentient.com.au --- Comment #4 from David Cook <dcook(a)prosentient.com.au> --- So I was just about to report this as a security vulnerability... My perspective is if you have top-level "plugins" permissions, you can run any method in a plugin, and that's bad. -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37021] New: REST API: Holds endpoint handles item_id as string in GET call
by bugzilla-daemon＠bugs.koha-community.org 18 Jul '25

18 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37021 Bug ID: 37021 Summary: REST API: Holds endpoint handles item_id as string in GET call Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: emmi.takkinen(a)koha-suomi.fi CC: tomascohen(a)gmail.com When one makes a GET call to holds endpoint and hold has item attached to it, item_id is handled as string not integer as it should. To reproduce: 1. Make sure you have hold waiting in your database. 1. Call endpoint api/v1/holds/?q=[{"me.status":"W"}]. 2. Note that holds item_id is displayed as item_id: "12345". -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 17

[Bug 37809] New: Add missing embeds to checkouts endpoints
by bugzilla-daemon＠bugs.koha-community.org 18 Jul '25

18 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37809 Bug ID: 37809 Summary: Add missing embeds to checkouts endpoints Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: tomascohen(a)gmail.com -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 26

[Bug 37032] New: REST API: Unable to call item info via holds endpoint
by bugzilla-daemon＠bugs.koha-community.org 18 Jul '25

18 Jul '25

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37032 Bug ID: 37032 Summary: REST API: Unable to call item info via holds endpoint Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: emmi.takkinen(a)koha-suomi.fi CC: tomascohen(a)gmail.com I'm trying to fetch items barcode via holds endpoint with no luck. If I've understood correctly, this should be possible by adding item as embed in /api/v1/swagger/paths/holds.yaml and then adding it to enum option in kohaTable function. However this only leads to following error: >Something went wrong when loading the table. >400: Bad Request. >Not in enum list: cancellation_requested, biblio, pickup_library, item. Documentation for endpoint shows that endpoint should produce item object and Koha::Hold does have relation to item. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 20