]> git.koha-community.org Git - koha.git/commit
Bug 16593: Do not allow patrons to delete search history of others patrons
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Thu, 26 May 2016 10:52:19 +0000 (11:52 +0100)
committerChris Cormack <chrisc@catalyst.net.nz>
Wed, 3 Aug 2016 20:26:58 +0000 (08:26 +1200)
commitdd93d0c662f6a6c0cf2abe236559b30e99f039c4
treeab1c77a544954f94ac206cd4ca8d5737f50544c3
parent59458a37813fede6b4f278682184aa6a275f3bc0
Bug 16593: Do not allow patrons to delete search history of others patrons

A malicious user can delete the search history of all other users by
correctly guessing the ID value assigned to the victim's search. As
searches are assigned values sequentially, an attacker could quickly
remove the searches belonging to all of the application's users.

To reproduce:
Login with patron A
launch a search
Note the id generated for this search history:
select id from search_history order by id desc limit 1;
Login with patron B
Hit /cgi-bin/koha/opac-search-history.pl?action=delete&id=<ID>
Note that the row is deleted in the DB

Test plan
Confirm that this patch fixes the issue.
The same test can be made at the staff interface

Reported by Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
catalogue/search-history.pl
opac/opac-search-history.pl