]> git.koha-community.org Git - koha.git/commit
Bug 16593: Do not allow patrons to delete search history of others patrons
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Thu, 26 May 2016 10:52:19 +0000 (11:52 +0100)
committerJulian Maurice <julian.maurice@biblibre.com>
Tue, 16 Aug 2016 12:22:08 +0000 (14:22 +0200)
commiteb991bfcf96290aabf0c05085a8eaedafc530530
tree3ef504230a107a88ce4031c17589c4d4fcb4d351
parentb3266093f8c9e2d989dfc13a566958d617fafd26
Bug 16593: Do not allow patrons to delete search history of others patrons

A malicious user can delete the search history of all other users by
correctly guessing the ID value assigned to the victim's search. As
searches are assigned values sequentially, an attacker could quickly
remove the searches belonging to all of the application's users.

To reproduce:
Login with patron A
launch a search
Note the id generated for this search history:
select id from search_history order by id desc limit 1;
Login with patron B
Hit /cgi-bin/koha/opac-search-history.pl?action=delete&id=<ID>
Note that the row is deleted in the DB

Test plan
Confirm that this patch fixes the issue.
The same test can be made at the staff interface

Reported by Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit f01720808a574af9872ef3f562a8f3cee7f81060)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
(cherry picked from commit 0974bb38889dc5ca2b0abf68715a296d49087f3e)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
catalogue/search-history.pl
opac/opac-search-history.pl