[Bug 23872] New: Permissions can be subverted
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23872 Bug ID: 23872 Summary: Permissions can be subverted Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Mana-kb Assignee: koha-bugs@lists.koha-community.org Reporter: martin.renvoize@ptfs-europe.com Granular permissions for managing Mana-KB preferences were added with bug 22198 but access to those system preferences via the standard preferences page was not locked down.. As such, we have a hole in the permissions logic here. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23872 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Permissions can be |ManaKB Permissions can be |subverted |subverted -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23872 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@bugs.koha-c | |ommunity.org --- Comment #1 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Can you detail? I do not get it. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23872 --- Comment #2 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Test plan 1) Add a new user with 'manage_sysprefs' permission. 2) Note that this user can change Mana related sytem preferences via `Home › Administration › System preferences > Web services > Mana KB` regardless of whether that also have the `manage_mana` permission or not. Note: This is actually the same case for HEA prefs too. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23872 --- Comment #3 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Do we really need this specific permission? I would go for removing manage_mana and use manage_sysprefs instead. Or, if we really need it, add a warning in the pref's description. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23872 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|major |normal -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org