Bugzilla – Attachment 1898 Details for
Bug 4193
Authentication with cardnumber/password at intranet allows superlibrarian access
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
patch proposed
0001-Bug-fix-Authentication-with-cardnumber-allows-superl.patch (text/plain), 1.71 KB, created by
Chris Cormack
on 2010-02-16 10:45:00 UTC
(
hide
)
Description:
patch proposed
Filename:
MIME Type:
Creator:
Chris Cormack
Created:
2010-02-16 10:45:00 UTC
Size:
1.71 KB
patch
obsolete
>From 2acb35ba0673f2c9987be1db50c733cdd4cae896 Mon Sep 17 00:00:00 2001 >From: Henri-Damien LAURENT <henridamien.laurent@biblibre.com> >Date: Tue, 16 Feb 2010 11:24:49 +0100 >Subject: [PATCH] Bug fix: Authentication with cardnumber allows superlibrarian access > >un privileged users couls access intranet with superlibrarian rights >when login in with cardnumber/password >--- > C4/Auth.pm | 8 ++++---- > 1 files changed, 4 insertions(+), 4 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index f810fd3..c50658c 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -1258,11 +1258,11 @@ sub checkpw { > my ( $md5password, $cardnumber, $borrowernumber, $userid, $firstname, > $surname, $branchcode, $flags ) > = $sth->fetchrow; >- if ( md5_base64($password) eq $md5password ) { >+ if ( ( md5_base64($password) eq $md5password ) and ($md5password ne "!") ) { > > C4::Context->set_userenv( $borrowernumber, $userid, $cardnumber, > $firstname, $surname, $branchcode, $flags ); >- return 1, $userid; >+ return 1, $cardnumber; > } > } > if ( $userid && $userid eq C4::Context->config('user') >@@ -1416,8 +1416,8 @@ Returns member's flags or 0 if a permission is not met. > > sub haspermission { > my ($userid, $flagsrequired) = @_; >- my $sth = C4::Context->dbh->prepare("SELECT flags FROM borrowers WHERE userid=?"); >- $sth->execute($userid); >+ my $sth = C4::Context->dbh->prepare("SELECT flags FROM borrowers WHERE userid=? or cardnumber=?"); >+ $sth->execute($userid,$userid); > my $flags = getuserflags( $sth->fetchrow(), $userid ); > if ( $userid eq C4::Context->config('user') ) { > # Super User Account from /etc/koha.conf >-- >1.6.3.3 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 4193
: 1898