Bug 14440

Summary: get_template_and_user can not have an empty template_name
Product: Koha Reporter: Fridolin Somers <fridolin.somers>
Component: Staff interfaceAssignee: Fridolin Somers <fridolin.somers>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: chris, gfloresm, gmcharlt, indradg, jonathan.druart, katrin.fischer, liz, mtj, tomascohen
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 14408    
Bug Blocks:    
Attachments: Bug 14440 - get_template_and_user can not have an empty template_name (updatesupplier.pl)
bug 14440 - work around for empty tt filenames
Bug 14440 - get_template_and_user can not have an empty template_name (opac-ratings.pl)
Bug 14440: get_template_and_user can not have an empty template_name (quote*_ajax.pl)
Bug 14440 - get_template_and_user can not have an empty template_name (updatesupplier.pl)
Bug 14440 - get_template_and_user can not have an empty template_name (opac-ratings.pl)
Bug 14440: get_template_and_user can not have an empty template_name (quote*_ajax.pl)
(qa fix) sysprefs order and TT plugin access
[SIGNED OFF] Bug 14440: get_template_and_user can not have an empty template_name (updatesupplier.pl)
[SIGNED OFF] Bug 14440: get_template_and_user can not have an empty template_name (opac-ratings.pl)
[SIGNED OFF] Bug 14440: get_template_and_user can not have an empty template_name (quote*_ajax.pl)
[PASSED QA] Bug 14440: get_template_and_user can not have an empty template_name (updatesupplier.pl)
[PASSED QA]  Bug 14440: get_template_and_user can not have an empty template_name (opac-ratings.pl)
[PASSED QA]  Bug 14440: get_template_and_user can not have an empty template_name (quote*_ajax.pl)
[3.18.x] Bug 14440: get_template_and_user can not have an empty template_name (opac-ratings.pl)

Description Fridolin Somers 2015-06-23 14:06:11 UTC
Since Bug 14408, the method get_template_and_user can not have an empty template_name.
Pages calling with an empty value should useC4::Auth::haspermission.
Comment 1 Fridolin Somers 2015-06-23 14:09:48 UTC
Concerned pages :

acqui/updatesupplier.pl
opac/opac-ratings.pl
tools/quotes/quotes_ajax.pl
tools/quotes/quotes-upload_ajax.pl
Comment 2 Fridolin Somers 2015-06-23 14:29:19 UTC
In fact, pages should use C4::Auth::checkauth()
Comment 3 Fridolin Somers 2015-06-23 15:17:09 UTC Comment hidden (obsolete)
Comment 4 Chris Cormack 2015-06-23 23:03:28 UTC
A work around is to do

- template_name   => ""
+ template_name   => "/errors/404.tt"

(any template that exists will do, it is never printed, we just redirect)
Comment 5 Liz Rea 2015-06-23 23:23:49 UTC Comment hidden (obsolete)
Comment 6 Fridolin Somers 2015-06-24 07:24:05 UTC Comment hidden (obsolete)
Comment 7 Fridolin Somers 2015-06-24 07:25:05 UTC
(In reply to Liz Rea from comment #5)
> Created attachment 40544 [details] [review] [review]
> bug 14440 - work around for empty tt filenames
> 
> This is a work around for the bug of not accepting empty template names.
> 
> To test:
> 
> Make sure all of these functions still work.

Thanks Liz, maybe we could use this patch to fix quickly on stable branches
Comment 8 Jonathan Druart 2015-06-24 09:06:23 UTC Comment hidden (obsolete)
Comment 9 Fridolin Somers 2015-06-24 13:37:13 UTC
Thanks Jonathan, I'm not very familiar with Ajax.
( except when cleaning the house :D )
Comment 10 Indranil Das Gupta 2015-06-24 17:31:37 UTC Comment hidden (obsolete)
Comment 11 Indranil Das Gupta 2015-06-24 19:51:01 UTC Comment hidden (obsolete)
Comment 12 Indranil Das Gupta 2015-06-24 19:53:53 UTC Comment hidden (obsolete)
Comment 13 Indranil Das Gupta 2015-06-24 20:15:50 UTC Comment hidden (obsolete)
Comment 14 Tomás Cohen Arazi 2015-06-24 21:27:56 UTC Comment hidden (obsolete)
Comment 15 Tomás Cohen Arazi 2015-06-24 21:28:05 UTC Comment hidden (obsolete)
Comment 16 Tomás Cohen Arazi 2015-06-24 21:28:14 UTC Comment hidden (obsolete)
Comment 17 Katrin Fischer 2015-06-25 09:03:42 UTC
Created attachment 40620 [details] [review]
[PASSED QA] Bug 14440: get_template_and_user can not have an empty template_name (updatesupplier.pl)

Since Bug 14408, the method get_template_and_user can not have an empty template_name.
Pages calling with an empty value should use C4::Auth::checkauth()

This patch corrects acqui/updatesupplier.pl

Test plan :
- Apply patch
- Connect to intranet with a user having "vendors_manage" permission
- Go to acquisition module
- Create a new vendor
- Click on "Edit vendor"
- Change some information and save
=> Your change is saved
- Connect to intranet with a user not having "vendors_manage" permission
- Try to access <intranet>/cgi-bin/koha/acqui/updatesupplier.pl
=> Access is denied
- Disconnect from intranet
- Try to access <intranet>/cgi-bin/koha/acqui/updatesupplier.pl
=> Access is denied

Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 18 Katrin Fischer 2015-06-25 09:03:45 UTC
Created attachment 40621 [details] [review]
[PASSED QA]  Bug 14440: get_template_and_user can not have an empty template_name (opac-ratings.pl)

Since Bug 14408, the method get_template_and_user can not have an empty template_name.
Pages calling with an empty value should use C4::Auth::checkauth()

This patch corrects opac/opac-ratings.pl

Test plan :
- Apply patch
- Set sysopref OpacStarRatings to 'results and details'
- Disable Javascipt on your browser (otherwise it will use ajax)
- Login at OPAC
- Go to a record
- Click on a button left of 'Rate me' to choose a rating, ie 4
- Click on 'Rate me'
=> The page is reloaded and you see 'your rating: 4'
- Loggout from OPAC
- Try to access URL : http://<serveur>/cgi-bin/koha/opac-ratings.pl
=> You see the loggin page

Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Comment 19 Katrin Fischer 2015-06-25 09:03:48 UTC
Created attachment 40622 [details] [review]
[PASSED QA]  Bug 14440: get_template_and_user can not have an empty template_name (quote*_ajax.pl)

This patch uses check_api_auth instead of get_template_and_user.

Test plan:
Confirm that you are still able to access to the quote editor with the
edit_quotes permission.
Confirm that you are not if you don't have the permission.

wget your_url/cgi-bin/koha/tools/quotes/quotes_ajax.pl
should return "403 : Forbidden."

Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Comment 20 Katrin Fischer 2015-06-25 12:14:37 UTC
Hm, I have problems applying those patches on 3.18.x, we might need a slightly different/rebased version there.
Comment 21 Tomás Cohen Arazi 2015-06-25 17:52:47 UTC
Patches pushed to master.

Thanks Frido and Jonathan!
Comment 22 Chris Cormack 2015-06-25 21:09:06 UTC
Pushed to 3.20.x will be in 3.20.2
Comment 23 Katrin Fischer 2015-06-26 07:38:23 UTC
The patch for the ratings needs to be amended to work correctly on 3.18 - resolving the conflict and removing all the 'use' as in the patch will break the feature it looks like.
Comment 24 Katrin Fischer 2015-06-26 08:00:25 UTC
Created attachment 40648 [details] [review]
[3.18.x] Bug 14440: get_template_and_user can not have an empty template_name (opac-ratings.pl)

Since Bug 14408, the method get_template_and_user can not have an empty template_name.
Pages calling with an empty value should use C4::Auth::checkauth()

This patch corrects opac/opac-ratings.pl

Test plan :
- Apply patch
- Set sysopref OpacStarRatings to 'results and details'
- Disable Javascipt on your browser (otherwise it will use ajax)
- Login at OPAC
- Go to a record
- Click on a button left of 'Rate me' to choose a rating, ie 4
- Click on 'Rate me'
=> The page is reloaded and you see 'your rating: 4'
- Loggout from OPAC
- Try to access URL : http://<serveur>/cgi-bin/koha/opac-ratings.pl
=> You see the loggin page

Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>

Conflicts:
	opac/opac-ratings.pl
Comment 25 Katrin Fischer 2015-06-26 08:01:44 UTC
I think the last patch I attached should work for 3.18.x. But please double check before this is used!
Comment 26 Katrin Fischer 2015-07-18 18:36:39 UTC
*** Bug 14563 has been marked as a duplicate of this bug. ***
Comment 27 Liz Rea 2015-07-20 22:01:18 UTC
Pushed to 3.18.x, will be in 3.18.09

Used the 3.18.x patch for opac-ratings, thanks Katrin.
Comment 28 Mason James 2015-07-25 10:33:56 UTC
Pushed to 3.16.x, will be in 3.16.13