← Previous day | Today | Next day → | Search | Index
All times shown according to UTC.
Time | Nick | Message |
---|---|---|
00:00 | tcohen | bug 11672 |
00:00 | huginn | 04Bug http://bugs.koha-community.org[…]_bug.cgi?id=11672 normal, P5 - low, ---, tomascohen, Pushed to Master , Untranslatable report areas in step 1 of Guided Reports |
00:00 | tcohen | it isn't on the stable branch, so nevermind :-D |
00:03 | NateC joined #koha | |
00:06 | cait | good night all :) |
00:06 | cait left #koha | |
00:07 | bgkriegel__ | tcohen: yes, they appear |
00:07 | tcohen | ok, managed to exploit vulnerability on git installs |
00:09 | dcook | tcohen: The bash one? |
00:09 | or is this a Koha specific one? | |
00:09 | tcohen | just the bash one |
00:09 | gityfied setups vulnerable | |
00:09 | however it is written :-P | |
00:09 | rangi | quick fix is an .htaccess |
00:10 | dcook | I don't think I have any git installs open to the internet |
00:10 | But I think Bywater exclusively use git installs.. | |
00:10 | kmlussier joined #koha | |
00:10 | rangi | theyve been switching to packages |
00:10 | dcook | Sweet |
00:10 | tcohen | some people deploy with dev installs |
00:10 | rangi | plus im sure they are upgrading |
00:11 | hopefully those who do dev installs, are patching :) | |
00:11 | dcook | Yeah, I tried to exploit the vulnerability but we have proxies in front and they're not using bash. |
00:11 | tcohen | curl -H 'User-Agent: () { :;}; /usr/bin/touch /tmp/hacked' http://koha-dev.biblioadmin/ |
00:11 | ^^^ ^^ that's what I did | |
00:12 | dcook | Yeah, I did that as well |
00:12 | tcohen | i don't think a proxy would prevent it |
00:12 | rangi | some proxies strip user agent |
00:12 | tcohen | (i don't think they mangle the UA) |
00:12 | ah | |
00:12 | dcook | I tried a few other headers as well |
00:12 | rangi | if they did that, it would |
00:12 | tcohen | bad guys |
00:12 | eythian | you can use almost any header |
00:12 | dcook | ^ |
00:12 | rangi | but yeah |
00:12 | tcohen | exactly |
00:13 | rangi | i wouldnt be sure a proxy is safer |
00:13 | id patch bash and put .htaccess in | |
00:13 | dcook | The proxy doesn't have bash, but yeah still patched bash anyway |
00:13 | rangi | to stop the dirs that shouldnt be accessible being accessible :) |
00:13 | tcohen | we could push a .htaccess |
00:13 | rangi | doesnt matter if the proxy has bash or not |
00:13 | dcook | Mmm, we do have a more locked down vhost than the standard Koha install as well.. |
00:13 | Although it would still be able to touch tmp | |
00:14 | rangi: I just mean that the proxy isn't going to execute any code. | |
00:14 | rangi | *nod* but whatever it passes through to will :) |
00:14 | dcook | And if it does something to the strings it passes to the backend server that does have bash... then nada |
00:14 | It didn't though | |
00:14 | tcohen | dcook: if you can run touch /tmp |
00:14 | then you can inject whatever | |
00:15 | dcook | tcohen: ? |
00:15 | rangi | unless the proxy is stripping all headers and user agents, from the request it passes to the webserver, theres still a way in |
00:15 | dcook | rangi: I expected the proxied server to execute the bash but it didn't :/ |
00:15 | It must be stripping them all | |
00:15 | eythian | dcook: that's not how it works |
00:15 | rangi | you can see if you look in the access logs |
00:16 | dcook | rangi: Yeah, I was thinking about being a bit more thorough in checking the logs |
00:16 | eythian: How do you mean? | |
00:16 | eythian | dcook: it won't be shelling to anything to proxy a request. |
00:16 | dcook | eythian: That's not what I meant |
00:16 | eythian: At least I don't think that's what I meant :p | |
00:16 | tcohen | this baby would run a remote shell using a pipe on /tmp http://pastebin.com/dEYQndKG |
00:16 | dcook | eythian: I figured the proxy would pass the string as is to the Koha server |
00:16 | eythian | ah, it will, in general |
00:16 | dcook | eythian: And the Koha server would execute the code via the bash vulnerability |
00:17 | But it didn't | |
00:17 | eythian | if it didn't, everything would break. |
00:17 | well, koha doesn't run a shell, in most cases. | |
00:17 | it usually calls perl, and perl doesn't have the issue. | |
00:17 | dcook | Isn't Apache setting environmental variables though? |
00:17 | tcohen | it will only happen if you point to a .sh file in CGI-mode |
00:17 | rangi | dcook: you have to hit the right url, eg one a dev install |
00:17 | eythian | dcook: yes, but it's bash that takes those variables and causes problems with them |
00:17 | perl doesn't care | |
00:18 | dcook | Right |
00:18 | rangi | where some of the .sh files are accessible |
00:18 | eythian | and if there's no bash in the pipeline, nothing is going to happen |
00:18 | dcook | eythian: Unless it's shelling out for whatever reason |
00:18 | eythian | which isn't something we do in koha so far as I could tell with a quick scan. |
00:18 | dcook | I think the only time we do is for rebuild_zebra.pl? |
00:18 | eythian | you never run that from apache |
00:19 | dcook | True true |
00:19 | Although I think it was suggested at one point :p | |
00:19 | eythian | even then, we're probably not launching a shell from within it. |
00:20 | dcook | I thought commands like "system" and such generally used a subshell |
00:20 | eythian | nope |
00:20 | "Does exactly the same thing as "exec LIST", except that a fork is done first and the parent process | |
00:20 | waits for the child process to exit." | |
00:21 | exec calls execvp(3) which loads the new code over the top of current process | |
00:21 | tcohen | a 'system' call is an attack vector |
00:22 | eythian | no shell in there, unless you do it yourself. |
00:22 | tcohen | ah |
00:22 | so we are safe even if we pass user-provided stuff | |
00:22 | eythian | you have to be mega careful when calling a shell anyway, because shell injection is a thing that's been around forever. |
00:23 | yes, though I still prefer to whitelist, as there could be other bugs. | |
00:23 | rangi | the only danger afaict that is koha specific is if you are running on a git install |
00:23 | eythian | e.g. a buffer overflow in argument processing. |
00:24 | rangi: time for steak? | |
00:24 | rangi | yep :) |
00:25 | bbiab | |
00:26 | dcook | Mmm food |
00:26 | tcohen: So the git install calls a shell script on the main page? | |
00:27 | tcohen | dcook: sorry, wrong line |
00:27 | curl -H 'User-Agent: () { :;}; /usr/bin/touch /tmp/hacked' http://koha-dev.biblioadmin/cg[…]sc/bin/sip_run.sh | |
00:27 | ^^^^ that was the one | |
00:27 | and you notice the problem more clearly | |
00:28 | sorry for the confussion | |
00:28 | dcook | Mmm, I gotcha now |
00:28 | I see now about the .htaccess as well | |
00:28 | All has been made clear :D | |
00:28 | * tcohen | is glad to hear |
00:29 | * dcook | now seeks to unlock his wife's disabled ipad |
00:29 | tcohen | dcook: go to greece, leave the IRC |
00:29 | dcook | Ah, I don't leave for another... 11 hours :) |
00:29 | Still have a full day of work left ahead of me | |
00:29 | And last minute prep | |
00:35 | tcohen | :_D |
00:39 | wizzyrea | hm yeah git installs on the public internet are kind of scary |
00:40 | dcook | totes |
00:41 | * dcook | sings a song he just invented about multitasking |
00:41 | dcook | It's basically just me singing "multitasking" over and over again |
00:48 | Bloody hell, Apple... | |
00:48 | I guess it's secure but yikes | |
00:51 | wizzyrea | @later tell oleonard in the process of looking for something else, I found this little gem of a conversation http://irc.koha-community.org/[…]3-10-03#i_1397312 |
00:51 | huginn | wizzyrea: The operation succeeded. |
01:00 | dcook | So it turns out 6 or so password tries and your Apple device is totally bricked until you reset the device to factory settings |
01:00 | Ideally, you've backed up your device recently, so it shouldn't matter too much. | |
01:01 | wizzyrea | errrrr really? |
01:01 | dcook | Yeppers |
01:01 | Fortunately this is a tablet and not a phone. A phone would be much worse. | |
01:01 | wizzyrea | that seems... unnecessaryl |
01:01 | * dcook | is glad this happened the day before we leave for holiday rather than "on" holiday |
01:01 | dcook | wizzyrea: Agreed |
01:01 | wizzyrea | nothing you can do from the web interface? |
01:01 | dcook | Nopes |
01:01 | That would just make sense :) | |
01:01 | wizzyrea | after logging in and giving a blood sample |
01:02 | and presenting an original of the purchase receipt | |
01:02 | dcook | Or even say your Apple ID and password |
01:02 | wizzyrea | that is nowhere near secure enough. |
01:02 | ^.^ | |
01:03 | dcook | When compared with the blood sample, sure :p |
01:03 | It would be hackable. | |
01:03 | Being able to remotely erase a device is certainly different to remotely unlocking. | |
01:04 | Of course, if you backup to the cloud, and your cloud gets hacked anyway... | |
01:04 | Then the security of protecting your data on your device becomes a bit moot | |
01:05 | Honestly, I kind of like this idea. | |
01:05 | I think you can plug away endlessly at an Android device | |
01:07 | nengard joined #koha | |
01:19 | wizzyrea | possibly so |
01:20 | locking people out and requiring a factory wipe though | |
01:20 | that seems excessive. | |
01:21 | they could 2 factor it, make you login online and (send an email, text, phone call, etc) | |
01:21 | that would require effort for them though. | |
01:21 | dcook | Hmm, doable though |
01:21 | Since it's Apple, it would be pretty easy too | |
01:22 | I liked my ipod classic, but since it was getting older and ultimately stolen, I don't miss Apple | |
01:22 | * dcook | enjoys his Android tablet and phone |
01:22 | wizzyrea | yeah same |
01:22 | eythian | androids lock out |
01:23 | but they lock out to require your google creds I think | |
01:23 | dcook | eythian: Might be a setting for that? Or maybe I just enter my password correctly most of the time |
01:23 | wizzyrea | i haven't ever had that problem |
01:23 | eythian | which apparently is an issue if you have wifi off on a tablet. |
01:23 | It takes quite a few goes | |
01:23 | wizzyrea | (oops) |
01:23 | dcook | 25 maybe? |
01:23 | eythian | I've heard it happening to people. |
01:23 | dcook | 25 sounds familiar.. |
01:23 | eythian | p'raps |
01:23 | dcook | Interesting :) |
01:23 | wizzyrea | can't say I've ever messed it up that many times. |
01:23 | dcook | Of course, I don't keep anything on my tablet |
01:24 | Nothing unique that is | |
01:24 | eythian | it looks like some models wipe at 10 |
01:24 | dcook | Just lots of comics O_O |
01:24 | eythian | but I think that's specific to those manufacturers. |
01:25 | wizzyrea | I want to know why the australia post just followed me. |
01:25 | dcook | Probably |
01:25 | wizzyrea | on twitter. |
01:25 | dcook | wizzyrea: Yeah, they followed me a while ago too. It's weird. |
01:25 | Is it verified? | |
01:25 | * dcook | suspects perhaps that it is not actually the AP |
01:25 | dcook | wth... Java, you're killing me |
01:25 | I already installed the third party library.. | |
01:27 | Well, Maven that's killing me.. | |
01:28 | Mmm, I have an ideer.. | |
01:28 | DSpace should have a more global community, so I wouldn't have to rant about DSpace related things to you folks :p | |
01:30 | Mmmm.. | |
01:30 | * dcook | has a feeling Maven is saying build successful when it's actually not... |
01:40 | dcook | Yee-ah. That's what I'm talkin' 'bout. |
01:52 | tcohen | night #koha |
01:53 | dcook | night tcohen :) |
01:53 | See you in a month :) | |
01:53 | Err talk to you in a month | |
01:53 | Have a good Kohacon! | |
01:57 | wizzyrea | have fun dcook |
02:09 | dcook | thanks wizzyrea :) |
02:09 | Still 5 hours before I head out for the day :) | |
02:10 | wizzyrea | oh never mind then. |
02:10 | * dcook | just likes collecting well wishes he guesses |
04:18 | wizzyrea | ok, well it's beer o'clock in NZ, dcook, have an excellent time, take lots of pictures, have a great time, and come home safely. |
04:18 | redundant wizzy is redundant | |
04:19 | dcook | :) |
04:19 | Thanks, wizzyrea :) | |
04:19 | I'll try to have a both excellent and great time :) | |
04:19 | We'll be safe and have fun! | |
04:19 | Also lots of photos. | |
04:19 | Enjoy beer o'clock! | |
04:27 | eythian | hi dcook |
04:27 | bye dcook, enjoy Greece | |
04:27 | ! | |
04:50 | dcook | Thanks, eythian! |
04:55 | Bloody Apple... | |
04:55 | Resetting this iPad has been such a labour.. | |
04:56 | continues to be* | |
05:17 | dbs joined #koha | |
05:30 | magnuse joined #koha | |
05:32 | * magnuse | waves |
05:36 | dcook | yo magnuse |
05:51 | magnuse | wassup dcook |
05:51 | in da house! | |
05:51 | @wunder boo | |
05:51 | huginn | magnuse: The current temperature in Bodo, Norway is 8.0°C (7:20 AM CEST on September 26, 2014). Conditions: Light Rain. Humidity: 81%. Dew Point: 5.0°C. Windchill: 4.0°C. Pressure: 29.09 in 985 hPa (Falling). |
05:53 | dcook | hehe |
05:53 | Scrambling to finish up a few things all at once in my last hour or so of work ;) | |
05:54 | cait joined #koha | |
06:06 | phat joined #koha | |
06:10 | magnuse | kia ora cait |
06:19 | cait | kia ora :) |
06:38 | reiveune joined #koha | |
06:38 | reiveune | hello |
06:41 | magnuse joined #koha | |
06:49 | alex_a joined #koha | |
06:49 | alex_a | bonjour |
06:50 | paul_p joined #koha | |
06:55 | sophie_m joined #koha | |
06:56 | Joubu | Bonjour |
06:56 | wahanui | what's up, Joubu |
07:02 | dcook | Ahhh |
07:02 | Holiday loooooooms! | |
07:02 | So exciting | |
07:13 | fridolin joined #koha | |
07:14 | fridolin | hie all |
07:27 | akafred joined #koha | |
07:27 | gaetan_B joined #koha | |
07:28 | gaetan_B | hello |
07:36 | cait | bye all... spending another day on atrain |
07:36 | cait left #koha | |
07:57 | Joubu | magnuse: what do you think about the new patch on bug 10743? |
07:57 | huginn | 04Bug http://bugs.koha-community.org[…]_bug.cgi?id=10743 enhancement, P5 - low, ---, nengard, RESOLVED FIXED, add style to privacy rules |
07:58 | Joubu | hum... not this one |
07:58 | bug 10473 | |
07:58 | huginn | 04Bug http://bugs.koha-community.org[…]_bug.cgi?id=10473 normal, P3, ---, amitddng135, Signed Off , Prompt for confirmation if more than 99 items are being added |
08:01 | * magnuse | commented on the bug |
08:03 | Joubu | thanks magnuse! :) |
08:31 | gerundio joined #koha | |
08:42 | baskar joined #koha | |
09:13 | cait joined #koha | |
09:51 | cait | @wunder Konstanz |
09:51 | huginn | cait: The current temperature in Taegerwilen, Taegerwilen, Germany is 12.2°C (11:50 AM CEST on September 26, 2014). Conditions: Overcast. Humidity: 91%. Dew Point: 11.0°C. Pressure: 30.33 in 1027 hPa (Steady). |
10:05 | gaetan_B1 joined #koha | |
10:27 | cait | ashimema: around? |
10:42 | Kresk joined #koha | |
10:59 | cait left #koha | |
11:47 | tcohen joined #koha | |
11:54 | oleonard joined #koha | |
11:58 | oleonard | Hi #koha |
11:59 | sql whatcha-ma-jigger? | |
11:59 | wahanui | sql whatcha-ma-jigger is http://wiki.koha-community.org[…]L_Reports_Library |
11:59 | oleonard | Sweet. |
12:02 | tcohen | heh |
12:02 | morning | |
12:05 | magnuse | ¡hola! |
12:05 | cait joined #koha | |
12:06 | tcohen | hola Magnus |
12:11 | * cait | waves from another train |
12:16 | cait1 joined #koha | |
12:17 | cait1 | @wunder Cordoba, Argentina |
12:17 | huginn | cait1: The current temperature in Bo Alto de San Martin, Cordoba City, Argentina is 15.0°C (9:15 AM ART on September 26, 2014). Conditions: Scattered Clouds. Humidity: 36%. Dew Point: 0.0°C. Pressure: 30.24 in 1024 hPa (Rising). |
12:17 | * cait1 | tries to do a git bz attach but internet not working well :( |
12:27 | oleonard | I find that sorting checkouts by date due in circulation is broken in master |
12:28 | kmlussier joined #koha | |
12:31 | cait joined #koha | |
12:31 | cait | @wunder Dortmund |
12:31 | huginn | cait: Error: No such location could be found. |
12:31 | cait | @wunder Bochum |
12:31 | huginn | cait: The current temperature in Bochum Weitmar, Bochum, Germany is 16.7°C (2:25 PM CEST on September 26, 2014). Conditions: Mostly Cloudy. Humidity: 98%. Dew Point: 16.0°C. Pressure: 30.18 in 1022 hPa (Steady). |
12:33 | alex_a joined #koha | |
12:37 | cait | Joubu: around? |
12:45 | Joubu | cait: yep |
12:45 | cait | ah :) |
12:45 | i thik i figured it out | |
12:45 | i am looking at the serials claiming patch and the qa script noted aproblem with the pod | |
12:46 | Joubu | cait: 5342 ? |
12:46 | cait | yep |
12:46 | i have a tiny follow up adding a blank line - that seems to fix it | |
12:47 | don't worry, i will continue testing :) | |
12:48 | Joubu | cait: weird, I only get a warning on claims.tt about a tab chat |
12:48 | on which file did you get the pod error? | |
12:48 | cait | i fixed that too |
12:48 | for me it complained in serials.pm about a missing blank line before the =cut too | |
12:49 | around line 26xx | |
12:49 | Joubu | cait: ok. The patch does not change the pod... |
12:50 | cait | i know |
12:50 | not sure why the qa script picked it up | |
12:50 | but probably not bad adding the line | |
12:50 | Joubu | cait: yep, thanks! |
12:50 | cait | Joubu: do you know where we have a list of the numerical serial status? |
12:50 | hm maybe in the template | |
12:51 | Joubu | cait: yes. There is another patch, but still stuck in NSO I believe |
12:52 | cait: bug 11814, there is a list of serial status in it | |
12:52 | huginn | 04Bug http://bugs.koha-community.org[…]_bug.cgi?id=11814 enhancement, P5 - low, ---, jonathan.druart, Needs Signoff , Serial statuses should be stored in constants |
12:52 | cait | thx, i am looking at serials-collection.tt :) |
12:52 | oleonard | Ugh. git blame me, again. |
12:52 | cait | 7 = claimed :) |
12:53 | * cait | hands oleonard the box of cookies |
12:53 | oleonard | I have a feeling it's going to take the whole box |
12:53 | Joubu | :) |
12:55 | cait | oleonard: which piece of code is blaming you? |
12:55 | oleonard | It was my fix for Bug 12899 that broke sorting by date due of checkouts on the circ page |
12:55 | huginn | 04Bug http://bugs.koha-community.org[…]_bug.cgi?id=12899 normal, P5 - low, ---, oleonard, Pushed to Stable , Row grouping in checkouts table is alphabetical and layout depends on words chosen in translation |
12:57 | cma joined #koha | |
13:03 | esfs joined #koha | |
13:05 | Viktor joined #koha | |
13:07 | Viktor | Hi #koha |
13:08 | I happened to get bug 13 000 for something I wanted to discuss. Not shure if that's a good sign or not :) | |
13:08 | huginn | 04Bug http://bugs.koha-community.org[…]how_bug.cgi?id=13 normal, P2, ---, chris, CLOSED FIXED, aqbooksellers.pl is missing in /admin/ directory |
13:08 | Viktor | bug 13000 |
13:08 | huginn | 04Bug http://bugs.koha-community.org[…]_bug.cgi?id=13000 enhancement, P5 - low, ---, gmcharlt, NEW , Split additem.pl into three tabs to allow implicit posting of the form with [enter] |
13:57 | wajasu joined #koha | |
14:03 | druthb | @wunder 77063 |
14:03 | huginn | druthb: The current temperature in Briargrove Park, Houston, Texas is 24.3°C (9:02 AM CDT on September 26, 2014). Conditions: Clear. Humidity: 68%. Dew Point: 18.0°C. Pressure: 30.06 in 1018 hPa (Steady). |
14:27 | rambutan | @wunder 64507 |
14:27 | huginn | rambutan: The current temperature in Wyatt Park, St Joseph, Missouri is 19.8°C (9:27 AM CDT on September 26, 2014). Conditions: Mostly Cloudy. Humidity: 81%. Dew Point: 16.0°C. Pressure: 30.16 in 1021 hPa (Rising). |
14:52 | phasefx_ joined #koha | |
14:54 | cma joined #koha | |
14:54 | oleonard joined #koha | |
14:54 | magnuse joined #koha | |
14:54 | irma joined #koha | |
14:54 | ashimema joined #koha | |
14:54 | gmcharlt joined #koha | |
14:54 | wahanui joined #koha | |
14:54 | matts joined #koha | |
14:54 | jajm joined #koha | |
14:54 | dpavlin joined #koha | |
14:54 | fredericd joined #koha | |
14:59 | cait joined #koha | |
15:06 | reiveune left #koha | |
15:08 | Dyrcona joined #koha | |
15:12 | Joubu | cait: around? |
15:12 | cait | only for a quick moment more |
15:12 | Joubu | thanks to QA 5342 :) |
15:12 | cait | :) |
15:12 | Joubu | cait: just a quick question, about 6) |
15:12 | cait | i would have been a bit faster if my mobile broadband didn't decide to die and disappear |
15:12 | :( | |
15:12 | Joubu | did you have already a primary email? |
15:13 | or did you define it to test this patch? | |
15:13 | cait | hm no i entered it and saved it |
15:13 | Joubu | ok, you had to logout/login |
15:13 | cait | aha! |
15:13 | Joubu | Yep, I had the same problem :) |
15:13 | cait | so you can probably scratch 6) then :) |
15:13 | Joubu | thanks |
15:13 | cait | i thought as Paola tested it, it's like to be configuration or somethong on my side |
15:14 | but couldn't figure it out :) | |
15:15 | i guess the tests might pass for you too... maybe some data problem | |
15:16 | i will try to get back to this one soon :) | |
15:16 | bye all | |
15:36 | Joubu | have a good weed-end #koha! |
15:50 | fridolin | see u |
15:50 | fridolin left #koha | |
16:39 | kmlussier joined #koha | |
17:44 | Viktor joined #koha | |
18:56 | tcohen joined #koha | |
19:23 | cait joined #koha | |
19:23 | * cait | wave |
19:24 | rambutan | is there any place to post comments on the CoC? |
19:24 | cait | hi rambutan |
19:24 | rambutan | hi cait |
19:25 | cait | i think you could use the mailing list |
19:25 | i think there is an old thread, but probably could just start a new one | |
19:25 | rambutan | yea, I could |
19:48 | tcohen joined #koha | |
19:53 | cait | hi tcohen |
19:58 | tcohen | hi cait |
20:36 | Viktor joined #koha | |
22:02 | barton_away joined #koha | |
23:54 | sophie_m joined #koha | |
23:54 | sophie_m left #koha | |
23:59 | NateC joined #koha |
← Previous day | Today | Next day → | Search | Index