New subject: cics - bugs, SQL - injections (security) and other problems

13 Dec 2009

      I tried this extention on system but i now problems. Sorry for english. Need
help!

Otrs 2.4.5, ubuntu 7.04

1 - Not Event Based Notifications
after installing this extentions event based notifications is not working
anymore but before on Otrs 2.4.5 fine

2 - Memory Leak
i use mod_perl, after 1 h httpd take over 260mb Otrs is geting slow

3 - count of all tickets in escalation view not colected to the real count
of tickets
i found hard coded IDs in module
Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm line 91, my IDs in db is
different

# CiCS-capeIT
    my $ViewableState  = $Param{ViewableState} || 0;
    if ( $ViewableState ) {
        @ViewableLockIDs = ('1','2','3')
    }
# EO CiCS-capeIT

    if (@QueueIDs) {
        my $SQL = "SELECT count(*) FROM ticket st WHERE "
            . " st.ticket_state_id IN ( ${\(join ', ', @ViewableStateIDs)} )
AND "
            . " st.queue_id IN (";

4 - agent group permissions get ignored and SQL injections (security)

I found Kernel/Output/HTML/CustomerUserTicketCount.pm and us it. But it
shown more tickets as i find in system with my agent. As i can see no agent
permission check is in. Also security issues found, SQL injection possible -
just add SQL to From line of every incoming email and it get executed.

    my $SQL = "SELECT count(*) "
        ."FROM ticket t "
        ."WHERE "
        . " LOWER(customer_id) = '"
        . lc( $Param{Data}->{UserCustomerID} )
        . "' ";

    my $Count = 0;
    $Self->{DBObject}->Prepare( SQL => $SQL.$SQLExt );
    while ( my @Row = $Self->{DBObject}->FetchrowArray() ) {
        $Count = $Row[0];
    }

5 - count of all tickets are not collected to the real count of tickets

In file Kernel/Modules/AgentTicketQueue.pm i found hard coded IDs again.
# CiCS-capeIT
#    $Self->{ViewAll} = $Self->{ParamObject}->GetParam( Param => 'ViewAll'
)  || 0;
    my %Preferences = $Self->{UserObject}->GetPreferences(UserID =>
$Self->{UserID});
    $Self->{ViewAll} = $Self->{ParamObject}->GetParam( Param => 'ViewAll' )
        || $Preferences{ViewAllTickets} || '0';

    my @ViewableLockIDs = $Self->{LockObject}->LockViewableLock( Type =>
'ID' );
    if ( $Self->{ViewAll} ) {
        @ViewableLockIDs= qw(1 2 3);
    }
    $Self->{ViewableLockIDs} = \@ViewableLockIDs;

# EO CiCS-capeIT

6 - broken signs in AgentTicketZoom

i use GB2312 becaus of local email clients of clients, not utf8. But I see
utf8 is hard coded in ticket zoom. before was working fine on Otrs 2.4.5 -
maybe the problem is:

    use utf8;
    utf8::decode( $Param{ArticleContentFilterString} );

7 - problems with GUI
see pics

8 - 50% on translation is missing
see pics

9 - many patched files
i see also Kernel/System/Ticket.pm in package - so it seems if i install new
Otrs no new patches of new patch release get applied (this is maybe reason
on 1, see also http://bugs.otrs.org/show_bug.cgi?id=4257 which was already
fixed on Otrs 2.4.5)

cics - bugs, SQL - injections (security) and other problems

Nyung Zu

Torsten Thau

tags

participants (2)