Bugzilla – Attachment 31564 Details for
Bug 643
Allow override of 'debarred' status
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 643: Followup: Encrypt param 'forceallow' to prevent unauthorized override
Bug-643-Followup-Encrypt-param-forceallow-to-preve.patch (text/plain), 5.90 KB, created by
Marc Véron
on 2014-09-12 15:35:02 UTC
(
hide
)
Description:
Bug 643: Followup: Encrypt param 'forceallow' to prevent unauthorized override
Filename:
MIME Type:
Creator:
Marc Véron
Created:
2014-09-12 15:35:02 UTC
Size:
5.90 KB
patch
obsolete
>From c32e915293bcb07ec280dc0aea5b9ca845cef457 Mon Sep 17 00:00:00 2001 >From: =?UTF-8?q?Marc=20V=C3=A9ron?= <veron@veron.ch> >Date: Fri, 12 Sep 2014 17:29:23 +0200 >Subject: [PATCH] Bug 643: Followup: Encrypt param 'forceallow' to prevent > unauthorized override > >The 'forceallow' param uses now an encrypted param based on session, logged-in user and borrower (instead of 1) >--- > circ/circulation.pl | 15 ++++++++++++--- > .../intranet-tmpl/prog/en/modules/circ/circulation.tt | 12 ++++++------ > 2 files changed, 18 insertions(+), 9 deletions(-) > >diff --git a/circ/circulation.pl b/circ/circulation.pl >index 6c7529d..70d4342 100755 >--- a/circ/circulation.pl >+++ b/circ/circulation.pl >@@ -51,7 +51,7 @@ use Date::Calc qw( > Date_to_Days > ); > use List::MoreUtils qw/uniq/; >- >+use Digest::MD5 qw(md5_hex); > > # > # PARAMETERS READING >@@ -97,8 +97,6 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user ( > > my $branches = GetBranches(); > >-my $force_allow_issue = $query->param('forceallow') || 0; >- > my @failedrenews = $query->param('failedrenew'); # expected to be itemnumbers > our %renew_failed = (); > for (@failedrenews) { $renew_failed{$_} = 1; } >@@ -217,8 +215,17 @@ if ($findborrower) { > } > > # get the borrower information..... >+ >+my $force_allow_issue = ''; >+my $force_allow_code = ''; >+ > my $borrower; > if ($borrowernumber) { >+ >+ #Create an individual param for force allow >+ $force_allow_code = substr( md5_hex( $sessionID, $loggedinuser, $borrowernumber ), 5, 4); >+ $force_allow_issue = ($query->param('forceallow') eq $force_allow_code) || 0; >+ > $borrower = GetMemberDetails( $borrowernumber, 0 ); > my ( $od, $issue, $fines ) = GetMemberIssuesAndFines( $borrowernumber ); > >@@ -243,6 +250,7 @@ if ($borrowernumber) { > flagged => "1", > noissues => ($force_allow_issue) ? 0 : "1", > forceallow => $force_allow_issue, >+ forceallowcode => $force_allow_code, > expired => "1", > renewaldate => format_date("$renew_year-$renew_month-$renew_day") > ); >@@ -408,6 +416,7 @@ foreach my $flag ( sort keys %$flags ) { > $template->param( > noissues => ($force_allow_issue) ? 0 : 'true', > forceallow => $force_allow_issue, >+ forceallowcode => $force_allow_code, > ); > if ( $flag eq 'GNA' ) { > $template->param( gna => 'true' ); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt >index ed404ad..0e8bbd8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt >@@ -250,7 +250,7 @@ $(document).ready(function() { > [% IF CAN_user_circulate_force_checkout or HIGHHOLDS %] > <form method="post" action="/cgi-bin/koha/circ/circulation.pl" autocomplete="off"> > >-[% IF (forceallow) %]<input type="hidden" name="forceallow" value="1">[% END %] >+[% IF (forceallow) %]<input type="hidden" name="forceallow" value="[% forceallowcode %]">[% END %] > > [% IF ( RESERVED ) %] > <p> >@@ -291,7 +291,7 @@ $(document).ready(function() { > [% END %] > > <form method="get" action="/cgi-bin/koha/circ/circulation.pl"> >- [% IF (forceallow) %]<input type="hidden" name="forceallow" value="1">[% END %] >+ [% IF (forceallow) %]<input type="hidden" name="forceallow" value="[% forceallowcode %]">[% END %] > <input type="hidden" name="borrowernumber" value="[% borrowernumber %]" /> > <input type="hidden" name="duedatespec" value="[% duedatespec %]" /> > <input type="hidden" name="stickyduedate" value="[% stickyduedate %]" /> >@@ -341,7 +341,7 @@ $(document).ready(function() { > [% FOREACH book IN options %] > <br /> > <form method="post" action="/cgi-bin/koha/circ/circulation.pl" autocomplete="off"> >- [% IF (forceallow) %]<input type="hidden" name="forceallow" value="1">[% END %] >+ [% IF (forceallow) %]<input type="hidden" name="forceallow" value="[% forceallowcode %]">[% END %] > <input type="hidden" name="borrowernumber" value="[% borrowernumber %]" /> > <input type="hidden" name="duedatespec" value="[% duedatespec %]" /> > <input type="hidden" name="stickyduedate" value="[% stickyduedate %]" /> >@@ -453,7 +453,7 @@ No patron matched <span class="ex">[% message %]</span> > <fieldset id="circ_circulation_selectborrower" class="brief"> > <legend>Patron selection</legend> > >-[% IF (forceallow) %]<input type="hidden" name="forceallow" value="1">[% END %] >+[% IF (forceallow) %]<input type="hidden" name="forceallow" value="[% forceallowcode %]">[% END %] > <input type="hidden" name="branch" value="[% branch %]" /> > <input type="hidden" name="printer" value="[% printer %]" /> > <input type="hidden" name="duedatespec" value="[% duedatespec %]" /> >@@ -492,7 +492,7 @@ No patron matched <span class="ex">[% message %]</span> > <span id="clearscreen"><a href="/cgi-bin/koha/circ/circulation.pl" title="Clear screen">x</a></span> > [% END %] > >- [% IF (forceallow) %]<input type="hidden" name="forceallow" value="1">[% END %] >+ [% IF (forceallow) %]<input type="hidden" name="forceallow" value="[% forceallowcode %]">[% END %] > > <label for="barcode">Checking out to [% INCLUDE 'patron-title.inc' %]</label> > >@@ -615,7 +615,7 @@ No patron matched <span class="ex">[% message %]</span> > > [% IF (noissues && borrowernumber && CAN_user_circulate_force_checkout) %] > <div class="override_debarment"> >-<a href="/cgi-bin/koha/circ/circulation.pl?forceallow=1&borrowernumber=[% borrowernumber %]" class="btn btn-small">Override debarment temporarily</a> >+<a href="/cgi-bin/koha/circ/circulation.pl?forceallow=[% forceallowcode %]&borrowernumber=[% borrowernumber %]" class="btn btn-small">Override debarment temporarily</a> > </div> > [% END %] > >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 643
:
9010
|
28453
|
28753
|
30715
|
30716
|
30726
|
30727
|
31564
|
31837
|
31997
|
31998
|
31999
|
32120
|
32121
|
32122
|
32925
|
32946