[Bug 34306] New: Able to access tools without permission
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34306 Bug ID: 34306 Summary: Able to access tools without permission Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Tools Assignee: koha-bugs@lists.koha-community.org Reporter: cbrannon@cdalibrary.org QA Contact: testopia@bugs.koha-community.org In an attempt to work around bug 34288 until it is available to 22.11, I was checking to see if going straight to /cgi-bin/koha/labels/spinelabel-home.pl would be a reasonable workaround. Indeed, it does work, but it works for anyone that can get to the link, not just people that have permission to the tool. It does not seem that this tool is managed by the label_creator permission. Then I thought, maybe this permission only manages /cgi-bin/koha/labels/label-home.pl, so I tested that. But nope. I can bypass permissions and get to that page. Aren't permissions supposed to prevent you from getting to the tools at all? Anyone can easily share urls to pages. If all the permissions are doing is allowing a tool link to show, that is not much of a permission. I'm a bit concerned about this. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34306 Christopher Brannon <cbrannon@cdalibrary.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=34288 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34306 --- Comment #1 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- There are 2 levels of checks: * In the templates, to be able to hide links and such * In the .pl files for allowing or not to access the page This should not be a general problem. The permissions for the label home page are set quite low, this can be discussed. Currently it's catalogue: https://git.koha-community.org/Koha-community/Koha/src/branch/master/labels/... I am not sure why that is, but it could be changed to labels I think. Also for the other pages. Other tools have the expected stricter permissions, like notices and slips: https://git.koha-community.org/Koha-community/Koha/src/branch/master/tools/l... -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34306 --- Comment #2 from Christopher Brannon <cbrannon@cdalibrary.org> --- I think it would be a good idea to remain stricter in general. Because this page is not as strict, I am unable to post the link to these tools on the tools page temporarily to get around the issue on bug 34288. We should try to be consistent with the permissions. Unless someone can think of a good reason not to do so. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34306 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #3 from David Cook <dcook@prosentient.com.au> --- The title for this bug is misleading. There isn't anonymous access to /cgi-bin/koha/labels/spinelabel-home.pl. That page does require permission to access it. It looks like a case where it uses the "catalogue" permission when perhaps it could use the "tools > label_creator" subpermission instead. That said, changing the permission now could cause many staff to no longer be able to create spine labels after upgrading to a patched version. Since they're spine labels and not borrower information, I don't think it's too concerning. Perhaps a case could be made for requiring either "editcatalogue" or "tools > label_creator". Since spinelabel-home.pl is now accessible via Cataloguing rather than Tools, it might make sense to put it under the cataloguing permission. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34306 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Able to access tools |Update spine label tool to |without permission |use more appropriate | |permissions --- Comment #4 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #3)
label_creator". Since spinelabel-home.pl is now accessible via Cataloguing rather than Tools, it might make sense to put it under the cataloguing
Perhaps a case could be made for requiring either "editcatalogue" or "tools permission.
After reviewing bug 34288 that actually certainly looks like the path forward. I'm going to update the title to reflect that. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34306 --- Comment #5 from Christopher Brannon <cbrannon@cdalibrary.org> --- I disagree with the direction this is going. I do not necessarily want people that need to use the spine label tools to have access to other cataloging tools. If you change the permission altogether, you are changing how people use these tools. I would rather the permission label_creator permission remained the permission to this tool. If it is to remain on the cataloging menu, which makes sense, it should: 1) make the cataloging link to the page, and the cataloging page available 2) only control whether the label tools are available on the cataloging page 3) not give access to other cataloging tools 4) should not allow access to the tools like it does by going straight to their urls. David, you stated "There isn't anonymous access to /cgi-bin/koha/labels/spinelabel-home.pl. That page does require permission to access it." I cannot confirm your statement. I've tested this against a patron that does not have the label_creator permission, and she was able to access both tools. Another library also confirmed this. Please tell me where we are missing this. Is there another permission that might be allowing access to these tools somehow? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34306 --- Comment #6 from David Cook <dcook@prosentient.com.au> --- (In reply to Christopher Brannon from comment #5)
David, you stated "There isn't anonymous access to /cgi-bin/koha/labels/spinelabel-home.pl. That page does require permission to access it."
I cannot confirm your statement. I've tested this against a patron that does not have the label_creator permission, and she was able to access both tools. Another library also confirmed this. Please tell me where we are missing this. Is there another permission that might be allowing access to these tools somehow?
"Anonymous access" means unauthenticated access. That is, anyone on the Internet trying to access it. The original title made it sound like anyone could access the tool just by visiting the URL, which isn't the case. Currently, "/cgi-bin/koha/labels/spinelabel-home.pl" requires the "catalogue" permission. Counterintuitively, the "catalogue" permission is the permission that generally provides access to the staff interface. That's why any of your authenticated staff users with staff interface permission will be able to view and use that tool. It doesn't have serious security implications, but it is suboptimal. (In reply to Christopher Brannon from comment #5)
I would rather the permission label_creator permission remained the permission to this tool.
It's not currently the permission for this tool. That's why I talked about changing it to that permission. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34306 --- Comment #7 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Katrin Fischer from comment #1)
There are 2 levels of checks: * In the templates, to be able to hide links and such * In the .pl files for allowing or not to access the page
This should not be a general problem.
The permissions for the label home page are set quite low, this can be discussed. Currently it's catalogue:
https://git.koha-community.org/Koha-community/Koha/src/branch/master/labels/ label-home.pl#L34
I am not sure why that is, but it could be changed to labels I think. Also for the other pages.
Other tools have the expected stricter permissions, like notices and slips:
https://git.koha-community.org/Koha-community/Koha/src/branch/master/tools/ letter.pl#L84
I did explain which permission exactly in the first comment... just saying. "catalogue". -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org