Since Bug 14408, the method get_template_and_user can not have an empty template_name. Pages calling with an empty value should useC4::Auth::haspermission.
Concerned pages : acqui/updatesupplier.pl opac/opac-ratings.pl tools/quotes/quotes_ajax.pl tools/quotes/quotes-upload_ajax.pl
In fact, pages should use C4::Auth::checkauth()
Created attachment 40533 [details] [review] Bug 14440 - get_template_and_user can not have an empty template_name (updatesupplier.pl) Since Bug 14408, the method get_template_and_user can not have an empty template_name. Pages calling with an empty value should use C4::Auth::checkauth() This patch corrects acqui/updatesupplier.pl Test plan : - Apply patch - Connect to intranet with a user having "vendors_manage" permission - Go to acquisition module - Create a new vendor - Click on "Edit vendor" - Change some information and save => Your change is saved - Connect to intranet with a user not having "vendors_manage" permission - Try to access <intranet>/cgi-bin/koha/acqui/updatesupplier.pl => Access is denied - Disconnect from intranet - Try to access <intranet>/cgi-bin/koha/acqui/updatesupplier.pl => Access is denied
A work around is to do - template_name => "" + template_name => "/errors/404.tt" (any template that exists will do, it is never printed, we just redirect)
Created attachment 40544 [details] [review] bug 14440 - work around for empty tt filenames This is a work around for the bug of not accepting empty template names. To test: Make sure all of these functions still work.
Created attachment 40546 [details] [review] Bug 14440 - get_template_and_user can not have an empty template_name (opac-ratings.pl) Since Bug 14408, the method get_template_and_user can not have an empty template_name. Pages calling with an empty value should use C4::Auth::checkauth() This patch corrects opac/opac-ratings.pl Test plan : - Apply patch - Set sysopref OpacStarRatings to 'results and details' - Disable Javascipt on your browser (otherwise it will use ajax) - Login at OPAC - Go to a record - Click on a button left of 'Rate me' to choose a rating, ie 4 - Click on 'Rate me' => The page is reloaded and you see 'your rating: 4' - Loggout from OPAC - Try to access URL : http://<serveur>/cgi-bin/koha/opac-ratings.pl => You see the loggin page
(In reply to Liz Rea from comment #5) > Created attachment 40544 [details] [review] [review] > bug 14440 - work around for empty tt filenames > > This is a work around for the bug of not accepting empty template names. > > To test: > > Make sure all of these functions still work. Thanks Liz, maybe we could use this patch to fix quickly on stable branches
Created attachment 40559 [details] [review] Bug 14440: get_template_and_user can not have an empty template_name (quote*_ajax.pl) This patch uses check_api_auth instead of get_template_and_user. Test plan: Confirm that you are still able to access to the quote editor with the edit_quotes permission. Confirm that you are not if you don't have the permission. wget your_url/cgi-bin/koha/tools/quotes/quotes_ajax.pl should return "403 : Forbidden."
Thanks Jonathan, I'm not very familiar with Ajax. ( except when cleaning the house :D )
Created attachment 40595 [details] [review] Bug 14440 - get_template_and_user can not have an empty template_name (updatesupplier.pl) Since Bug 14408, the method get_template_and_user can not have an empty template_name. Pages calling with an empty value should use C4::Auth::checkauth() This patch corrects acqui/updatesupplier.pl Test plan : - Apply patch - Connect to intranet with a user having "vendors_manage" permission - Go to acquisition module - Create a new vendor - Click on "Edit vendor" - Change some information and save => Your change is saved - Connect to intranet with a user not having "vendors_manage" permission - Try to access <intranet>/cgi-bin/koha/acqui/updatesupplier.pl => Access is denied - Disconnect from intranet - Try to access <intranet>/cgi-bin/koha/acqui/updatesupplier.pl => Access is denied Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
Created attachment 40600 [details] [review] Bug 14440 - get_template_and_user can not have an empty template_name (opac-ratings.pl) Since Bug 14408, the method get_template_and_user can not have an empty template_name. Pages calling with an empty value should use C4::Auth::checkauth() This patch corrects opac/opac-ratings.pl Test plan : - Apply patch - Set sysopref OpacStarRatings to 'results and details' - Disable Javascipt on your browser (otherwise it will use ajax) - Login at OPAC - Go to a record - Click on a button left of 'Rate me' to choose a rating, ie 4 - Click on 'Rate me' => The page is reloaded and you see 'your rating: 4' - Loggout from OPAC - Try to access URL : http://<serveur>/cgi-bin/koha/opac-ratings.pl => You see the loggin page Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
Created attachment 40601 [details] [review] Bug 14440: get_template_and_user can not have an empty template_name (quote*_ajax.pl) This patch uses check_api_auth instead of get_template_and_user. Test plan: Confirm that you are still able to access to the quote editor with the edit_quotes permission. Confirm that you are not if you don't have the permission. wget your_url/cgi-bin/koha/tools/quotes/quotes_ajax.pl should return "403 : Forbidden." Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
Created attachment 40602 [details] [review] (qa fix) sysprefs order and TT plugin access Addresses the QA comments from Jonathan Druart in comment #6. http://bugs.koha-community.org/show_bug.cgi?id=11674
Created attachment 40607 [details] [review] [SIGNED OFF] Bug 14440: get_template_and_user can not have an empty template_name (updatesupplier.pl) Since Bug 14408, the method get_template_and_user can not have an empty template_name. Pages calling with an empty value should use C4::Auth::checkauth() This patch corrects acqui/updatesupplier.pl Test plan : - Apply patch - Connect to intranet with a user having "vendors_manage" permission - Go to acquisition module - Create a new vendor - Click on "Edit vendor" - Change some information and save => Your change is saved - Connect to intranet with a user not having "vendors_manage" permission - Try to access <intranet>/cgi-bin/koha/acqui/updatesupplier.pl => Access is denied - Disconnect from intranet - Try to access <intranet>/cgi-bin/koha/acqui/updatesupplier.pl => Access is denied Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Created attachment 40608 [details] [review] [SIGNED OFF] Bug 14440: get_template_and_user can not have an empty template_name (opac-ratings.pl) Since Bug 14408, the method get_template_and_user can not have an empty template_name. Pages calling with an empty value should use C4::Auth::checkauth() This patch corrects opac/opac-ratings.pl Test plan : - Apply patch - Set sysopref OpacStarRatings to 'results and details' - Disable Javascipt on your browser (otherwise it will use ajax) - Login at OPAC - Go to a record - Click on a button left of 'Rate me' to choose a rating, ie 4 - Click on 'Rate me' => The page is reloaded and you see 'your rating: 4' - Loggout from OPAC - Try to access URL : http://<serveur>/cgi-bin/koha/opac-ratings.pl => You see the loggin page Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Created attachment 40609 [details] [review] [SIGNED OFF] Bug 14440: get_template_and_user can not have an empty template_name (quote*_ajax.pl) This patch uses check_api_auth instead of get_template_and_user. Test plan: Confirm that you are still able to access to the quote editor with the edit_quotes permission. Confirm that you are not if you don't have the permission. wget your_url/cgi-bin/koha/tools/quotes/quotes_ajax.pl should return "403 : Forbidden." Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Created attachment 40620 [details] [review] [PASSED QA] Bug 14440: get_template_and_user can not have an empty template_name (updatesupplier.pl) Since Bug 14408, the method get_template_and_user can not have an empty template_name. Pages calling with an empty value should use C4::Auth::checkauth() This patch corrects acqui/updatesupplier.pl Test plan : - Apply patch - Connect to intranet with a user having "vendors_manage" permission - Go to acquisition module - Create a new vendor - Click on "Edit vendor" - Change some information and save => Your change is saved - Connect to intranet with a user not having "vendors_manage" permission - Try to access <intranet>/cgi-bin/koha/acqui/updatesupplier.pl => Access is denied - Disconnect from intranet - Try to access <intranet>/cgi-bin/koha/acqui/updatesupplier.pl => Access is denied Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Created attachment 40621 [details] [review] [PASSED QA] Bug 14440: get_template_and_user can not have an empty template_name (opac-ratings.pl) Since Bug 14408, the method get_template_and_user can not have an empty template_name. Pages calling with an empty value should use C4::Auth::checkauth() This patch corrects opac/opac-ratings.pl Test plan : - Apply patch - Set sysopref OpacStarRatings to 'results and details' - Disable Javascipt on your browser (otherwise it will use ajax) - Login at OPAC - Go to a record - Click on a button left of 'Rate me' to choose a rating, ie 4 - Click on 'Rate me' => The page is reloaded and you see 'your rating: 4' - Loggout from OPAC - Try to access URL : http://<serveur>/cgi-bin/koha/opac-ratings.pl => You see the loggin page Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Created attachment 40622 [details] [review] [PASSED QA] Bug 14440: get_template_and_user can not have an empty template_name (quote*_ajax.pl) This patch uses check_api_auth instead of get_template_and_user. Test plan: Confirm that you are still able to access to the quote editor with the edit_quotes permission. Confirm that you are not if you don't have the permission. wget your_url/cgi-bin/koha/tools/quotes/quotes_ajax.pl should return "403 : Forbidden." Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Hm, I have problems applying those patches on 3.18.x, we might need a slightly different/rebased version there.
Patches pushed to master. Thanks Frido and Jonathan!
Pushed to 3.20.x will be in 3.20.2
The patch for the ratings needs to be amended to work correctly on 3.18 - resolving the conflict and removing all the 'use' as in the patch will break the feature it looks like.
Created attachment 40648 [details] [review] [3.18.x] Bug 14440: get_template_and_user can not have an empty template_name (opac-ratings.pl) Since Bug 14408, the method get_template_and_user can not have an empty template_name. Pages calling with an empty value should use C4::Auth::checkauth() This patch corrects opac/opac-ratings.pl Test plan : - Apply patch - Set sysopref OpacStarRatings to 'results and details' - Disable Javascipt on your browser (otherwise it will use ajax) - Login at OPAC - Go to a record - Click on a button left of 'Rate me' to choose a rating, ie 4 - Click on 'Rate me' => The page is reloaded and you see 'your rating: 4' - Loggout from OPAC - Try to access URL : http://<serveur>/cgi-bin/koha/opac-ratings.pl => You see the loggin page Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar> Conflicts: opac/opac-ratings.pl
I think the last patch I attached should work for 3.18.x. But please double check before this is used!
*** Bug 14563 has been marked as a duplicate of this bug. ***
Pushed to 3.18.x, will be in 3.18.09 Used the 3.18.x patch for opac-ratings, thanks Katrin.
Pushed to 3.16.x, will be in 3.16.13