Bugzilla – Attachment 31377 Details for
Bug 12873
Reserve can be cancelled by any logged in user
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[PATCH] Bug 12873 - Reserve can be cancelled by any logged in user It is possible to cancel reservations through simply running opac-modreserve.pl with existing reserve_id number. This may provide remove even all reservations from system. The only limitat
PATCH-Bug-12873---Reserve-can-be-cancelled-by-any-.patch (text/plain), 1.47 KB, created by
Rafal Kopaczka
on 2014-09-04 14:54:37 UTC
(
hide
)
Description:
[PATCH] Bug 12873 - Reserve can be cancelled by any logged in user It is possible to cancel reservations through simply running opac-modreserve.pl with existing reserve_id number. This may provide remove even all reservations from system. The only limitat
Filename:
MIME Type:
Creator:
Rafal Kopaczka
Created:
2014-09-04 14:54:37 UTC
Size:
1.47 KB
patch
obsolete
>From 7f29c22b5630e29f04dab20ff52d24c1ca17896c Mon Sep 17 00:00:00 2001 >From: Rafal Kopaczka <rkk0@poczta.onet.pl> >Date: Thu, 4 Sep 2014 16:40:33 +0200 >Subject: [PATCH] [PATCH] Bug 12873 - Reserve can be cancelled by any logged > in user It is possible to cancel reservations through > simply running opac-modreserve.pl with existing reserve_id > number. This may provide remove even all reservations from > system. The only limitation is that user have to be logged > in. Simplest solution is to check whether reserve belongs > to user or not. > >Test plan: >1. Create reserves by 2 different users, and get their ID's >2. Before patch, hold may by cancelled by anyone who run site: >http://example.com/cgi-bin/koha/opac-modrequest.pl?reserve_id=XXX >3. After patch hold may by cancelled only by user whose reserve is. >--- > opac/opac-modrequest.pl | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > >diff --git a/opac/opac-modrequest.pl b/opac/opac-modrequest.pl >index cc1e3b3..e55a886 100755 >--- a/opac/opac-modrequest.pl >+++ b/opac/opac-modrequest.pl >@@ -45,7 +45,9 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( > my $reserve_id = $query->param('reserve_id'); > > if ($reserve_id && $borrowernumber) { >- CancelReserve({ reserve_id => $reserve_id }); >+ >+ my $reserve = GetReserve($reserve_id); >+ CancelReserve({ reserve_id => $reserve_id }) if $borrowernumber == $reserve->{borrowernumber} ; > } > > print $query->redirect("/cgi-bin/koha/opac-user.pl#opac-user-holds"); >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 12873
:
31377
|
31378
|
31379