gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 20083 - Information disclosure when (mis)using the MARC Preview feature 

The MARC Preview feature in the Staff client (catalogue/showmarc.pl) does not
check whether a user is logged in or not. As a consequence, it can be used to
obtain information that would normally be available to logged-in users only.
For example, you can view any bibliographic record by passing a value to the
'id' argument, but you can also view records as they were imported (normally
done via the 'Staged MARC management' tool).

All three 17.11 installations currently listed at
https://wiki.koha-community.org/wiki/Koha_Demo_Installations
are affected by this issue, as demonstrated by the URLs below:

http://koha.adminkuhn.ch:8080/cgi-bin/koha/catalogue/showmarc.pl?importid=1&viewas=html
http://pro.demo1711-koha.test.biblibre.eu/cgi-bin/koha/catalogue/showmarc.pl?id=1000&viewas=html
https://staff-kohademo.equinoxinitiative.org/cgi-bin/koha/catalogue/showmarc.pl?id=1&viewas=html

It should be noted that this only applies to XSLT-enabled installations.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
(cherry picked from commit 095a92a94e)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
Andreas Roussos 2018-01-26 14:12:47 +13:00 committed by Fridolin Somers
parent 5f446a5f0a
commit 09ae62a758
1 changed files with 11 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
catalogue/showmarc.pl
View File

@ -37,6 +37,17 @@ use C4::ImportBatch;
use C4::XSLT ();
my $input= new CGI;
my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
{
template_name => "catalogue/showmarc.tt",
query => $input,
type => "intranet",
authnotrequired => 0,
flagsrequired => { catalogue => 1 },
debug => 1,
}
);
my $biblionumber= $input->param('id');
my $importid= $input->param('importid');
my $view= $input->param('viewas')||'';
@ -70,16 +81,6 @@ if($view eq 'card' || $view eq 'html') {
Encode::encode_utf8(C4::XSLT::engine->transform($xml, $xsl));
}
else {
my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
{
template_name => "catalogue/showmarc.tt",
query => $input,
type => "intranet",
authnotrequired => 0,
flagsrequired => { catalogue => 1 },
debug => 1,
}
);
$template->param( MARC_FORMATTED => $record->as_formatted );
output_html_with_http_headers $input, $cookie, $template->output;
}