[Bug 40993] New: Do not allow direct calls of value_builder scripts
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Bug ID: 40993 Summary: Do not allow direct calls of value_builder scripts Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: m.de.rooy@rijksmuseum.nl QA Contact: testopia@bugs.koha-community.org See 37041/40943. On 40943 we check the correct session id now. But we still should not hit those value builder pages directly and generate 500s. But the login problem of 37041 has been addressed. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |40943 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40943 [Bug 40943] Store session_id in userenv -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |m.de.rooy@rijksmuseum.nl |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=37041 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 --- Comment #1 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 187723 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=187723&action=edit Bug 40993: Add Apache RewriteRule for hitting value_builder pages Test plan: Copy this file to /etc/koha. Restart Apache. Login to staff and hit a value builder page directly, e.g.: YOUR_SERVER/cgi-bin/koha/cataloguing/value_builder/marc21_field_005.pl Verify that you got redirected to 403. Verify that you can still edit a biblio record and open e.g. the leader plugin form. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au, | |jonathan.druart@gmail.com --- Comment #2 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Your follow-up here would be appreciated. Thanks. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 --- Comment #3 from David Cook <dcook@prosentient.com.au> --- (In reply to Marcel de Rooy from comment #2)
Your follow-up here would be appreciated. Thanks.
Catching up on my emails, but I'm adding a note to review this as soon as I can. At a glance, it looks pretty good although I think I might have a change to make. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=40943 Depends on|40943 | --- Comment #4 from David Cook <dcook@prosentient.com.au> --- Removing the dependency on bug 40943 because it doesn't require it to function. Moving it to See Also instead. Before the patch, I go to http://localhost:8081/cgi-bin/koha/cataloguing/value_builder/marc21_field_00... and it gives me a 500 With the patch: - sudo cp debian/templates/apache-shared-intranet.conf /etc/koha/apache-shared-intranet.conf - sudo service apache2 restart And that doesn't work because KTD doesn't use /etc/koha/apache-shared-intranet.conf it uses /etc/koha/apache-shared-intranet-git.conf So I'll manually include the line into /etc/koha/apache-shared-intranet-git.conf And that's looking good. I just have one tweak to make. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40943 [Bug 40943] Store session_id in userenv -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 --- Comment #5 from David Cook <dcook@prosentient.com.au> --- Created attachment 188185 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188185&action=edit Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #187723|0 |1 is obsolete| | --- Comment #6 from David Cook <dcook@prosentient.com.au> --- Created attachment 188186 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188186&action=edit Bug 40993: Add Apache RewriteRule for hitting value_builder pages Test plan: Copy this file to /etc/koha. Restart Apache. Login to staff and hit a value builder page directly, e.g.: YOUR_SERVER/cgi-bin/koha/cataloguing/value_builder/marc21_field_005.pl Verify that you got redirected to 403. Verify that you can still edit a biblio record and open e.g. the leader plugin form. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #188185|0 |1 is obsolete| | --- Comment #7 from David Cook <dcook@prosentient.com.au> --- Created attachment 188187 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=188187&action=edit Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action Signed-off-by: David Cook <dcook@prosentient.com.au> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 --- Comment #8 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to David Cook from comment #7)
Created attachment 188187 [details] [review] Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action
Signed-off-by: David Cook <dcook@prosentient.com.au>
Ah great, thx. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@openfifth.c | |o.uk See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=39522 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #188186|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #188187|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 --- Comment #9 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 190284 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=190284&action=edit Bug 40993: Add Apache RewriteRule for hitting value_builder pages Test plan: Copy this file to /etc/koha. Restart Apache. Login to staff and hit a value builder page directly, e.g.: YOUR_SERVER/cgi-bin/koha/cataloguing/value_builder/marc21_field_005.pl Verify that you got redirected to 403. Verify that you can still edit a biblio record and open e.g. the leader plugin form. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 --- Comment #10 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 190285 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=190285&action=edit Bug 40993: (QA follow-up) use L flag to stop the rewrite after PT action Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |26.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 --- Comment #11 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 26.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |release-notes-needed CC| |lucas@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |additional_work_needed --- Comment #12 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Tests are failing here now: ( xt/check_apache_conf.t ) # Subtest: Intranet RewriteRule statements 1..1 not ok 1 - All RewriteRule and RewriteCond directives must be copied to etc/koha-httpd.conf # Failed test 'All RewriteRule and RewriteCond directives must be copied to etc/koha-httpd.conf' # at /kohadevbox/koha/xt/check_apache_conf.t line 46. # got: '1' # expected: '0' # RewriteRule ^/cgi-bin/koha/cataloguing/value_builder/ /cgi-bin/koha/errors/403.pl [L,PT] # Looks like you failed 1 test of 1. not ok 1 - Intranet RewriteRule statements -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 --- Comment #13 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Will have a look -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 --- Comment #14 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Created attachment 191367 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=191367&action=edit Bug 40993: (follow-up) Add changes to etc/koha-httpd.conf Good to have a test :) Test plan: Run xt/check_apache_conf.t Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 --- Comment #15 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 191368 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=191368&action=edit Bug 40993: Update etc/koha-httpd.conf -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #191368|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|additional_work_needed | --- Comment #16 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- follow-up pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This report adds an Apache release notes| |RewriteRule to prevent | |hitting cataloguing | |value_builder scripts (aka | |framework plugins) | |directly. They are supposed | |to be called only via | |plugin_launcher.pl. Keywords|release-notes-needed | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Needs documenting --- Comment #17 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- This bug won't be backported to the 25.11.x branch as it has been deemed an enhancement or new feature. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40993 Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED --- Comment #18 from Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> --- Nothing to add or edit in the Koha manual regarding this change. Please reopen and provide more information is this is not the case. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org