]> git.koha-community.org Git - koha.git/commit
Bug 24878: Add authentication checks to the calendar tool
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Mon, 16 Mar 2020 15:26:48 +0000 (16:26 +0100)
committerLucas Gass <lucas@bywatersolutions.com>
Tue, 24 Mar 2020 20:45:08 +0000 (20:45 +0000)
commit96f6c110ed682aaa323e6094e9bfd19fde3b82db
treeb662de791cae2aa1ab9d6ecb675c73c9b103847f
parentdce4df939c330b8a61eb67cf7d40a3177457a58c
Bug 24878: Add authentication checks to the calendar tool

There is a security hole in 2 scripts that are used by the UI to edit
holidays.

To test:
1) Go to Tools -> Calendar, for Centerville
   Check no holiday for 30/4/2020
2) To add a new holiday without login execute
   a curl command with necessary parameters
3) Reload page from 1), verify the new holiday
   edit and delete the holiday
4) Apply the patch
5) Do 2) again, this time you get a lengthy output,
   with the magic words:

   <title>Koha &rsaquo;
       Log in to Koha
   </title>

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Only tested newHoliday but the fix is the same.
No errors

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Joy Nelson <joy@bywatersolutions.com>
(cherry picked from commit 656e7814b34d07534fa3a044f9cc7a8f4f4feea6)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
tools/exceptionHolidays.pl
tools/newHolidays.pl