https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28957 --- Comment #18 from David Nind <david@davidnind.com> --- Created attachment 208911 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208911&action=edit Bug 28957: Add permissions_required plugin hook to plugins/run.pl Currently plugins/run.pl always enforces { plugins => $method } to run any plugin method, so a plugin cannot require a different core permission per method or action. This forces sites to grant a "plugins" subpermission just to reach a plugin, which is both too coarse and a security concern (see this bug). This adds an optional plugin hook, permissions_required. If a plugin implements it, run.pl calls it (passing the invoked method and the CGI option/op parameter) and uses its return value as flagsrequired for get_template_and_user; otherwise behaviour is unchanged. The hook returns a standard flagsrequired structure, or undef to keep the default, so Koha still performs the actual authorization through haspermission(): a plugin can only select which existing permission gates a method, never bypass or weaken the check. If the hook dies or returns undef, run.pl safely falls back to the current default and, on error, logs a warning through Koha::Logger. Test plan: 1. Install a plugin that implements permissions_required, returning e.g. { editcatalogue => 'edit_items' } for method 'tool' with option 'items' and undef otherwise. (A sample plugin can be attached to this bug.) 2. Without the patch: confirm every plugin method invoked via plugins/run.pl requires the matching { plugins => $method } permission, regardless of what the plugin requests. 3. Apply the patch and restart. 4. With a plugin that does NOT implement permissions_required: confirm behaviour is unchanged (still requires { plugins => $method }). 5. As a user with 'edit_items' but without any 'plugins' permission, open plugins/run.pl?class=...&method=tool&option=items and confirm access is granted. 6. As the same user, open the same method without option=items and confirm access is denied (falls back to { plugins => 'tool' }). 7. Make the hook die: confirm run.pl falls back to { plugins => $method } and a warning is logged through Koha::Logger. Sponsored-by: Xercode Media Software S.L. Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.