To reproduce: Ensure that useDischarge syspref is off. Go to cgi-bin/koha/members/discharge.pl?borrowernumber=X Confirm that you are still able to access this page and generate discharge slip. This is a permissions breach
Created attachment 48082 [details] [review] Bug 15823: Can still access patron discharge slip without having the syspref on To test: 1) Ensure syspref useDischarge is disabled 2) Go to http://localhost:8081/cgi-bin/koha/members/discharge.pl?borrowernumber=X 3) Validate that you are still able to generate a discharge slip for this patron 4) Apply patch and refresh page 5) Confirm that you get an error message and can no longer generate a discharge.
Sponsored-by: Catalyst IT
Created attachment 48095 [details] [review] [SIGNED-OFF] Bug 15823: Can still access patron discharge slip without having the syspref on To test: 1) Ensure syspref useDischarge is disabled 2) Go to http://localhost:8081/cgi-bin/koha/members/discharge.pl?borrowernumber=X 3) Validate that you are still able to generate a discharge slip for this patron 4) Apply patch and refresh page 5) Confirm that you get an error message and can no longer generate a discharge. Sponsored-by: Catalyst IT NOTE: If the useDischarge system preference is enabled, there is a Discharge tab displayed when viewing patron details. This closes a direct URL issue. Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Hi Aleisha, It's still possible to generate a discharge even if the pref is off. For instance, you can get /cgi-bin/koha/members/discharge.pl?borrowernumber=42&discharge=1 And the pdf will be generated. Usually we check the additional permissions and prefs in the pl script. And either redirect to 404 or, more friendly, display an error message.
Created attachment 48308 [details] [review] Bug 15823: Can still access patron discharge slip without having the syspref on To test: 1) Ensure syspref useDischarge is disabled 2) Go to http://localhost:8081/cgi-bin/koha/members/discharge.pl?borrowernumber=X&discharge=1 3) Validate that you are still able to generate a discharge slip for this patron 4) Apply patch and refresh page 5) Confirm that you are redirected to the circulation.pl page for the user and that an error message is there. Sponsored-by: Catalyst IT
Created attachment 49181 [details] [review] Bug 15823: Can still access patron discharge slip without having the syspref on To test: 1) Ensure syspref useDischarge is disabled 2) Go to http://localhost:8081/cgi-bin/koha/members/discharge.pl?borrowernumber=X&discharge=1 3) Validate that you are still able to generate a discharge slip for this patron 4) Apply patch and refresh page 5) Confirm that you are redirected to the circulation.pl page for the user and that an error message is there. Sponsored-by: Catalyst IT Followed test plan, works as expected. Signed-off-by: Marc Véron <veron@veron.ch>
Aleisha, the problem also exists at the opac (opac-discharge.pl). Could you provide a fix (redirect to 404), in order to fix both interfaces in the same patch set?
Created attachment 50685 [details] [review] Bug 15823: Can still access patron discharge slip without having the syspref on EDIT: Fix for OPAC side To test: 1) Ensure syspref useDischarge is disabled 2) Go to /cgi-bin/koha/members/discharge.pl?borrowernumber=X&discharge=1 3) Validate that you are still able to generate a discharge slip for this patron 4) Apply patch and refresh page 5) Confirm that you are redirected to the circulation.pl page for the user and that an error message is there. OPAC SIDE 6) Go to the OPAC 7) Go to /cgi-bin/koha/opac-discharge.pl 8) Confirm you get a message saying discharges are disabled 9) Go to /cgi-bin/koha/opac-discharge.pl?op=request 10) Confirm you see same message Sponsored-by: Catalyst IT Followed test plan, works as expected. Signed-off-by: Marc Véron <veron@veron.ch>
Created attachment 50707 [details] [review] Bug 15823: Can still access patron discharge slip without having the syspref on EDIT: Fix for OPAC side To test: 1) Ensure syspref useDischarge is disabled 2) Go to /cgi-bin/koha/members/discharge.pl?borrowernumber=X&discharge=1 3) Validate that you are still able to generate a discharge slip for this patron 4) Apply patch and refresh page 5) Confirm that you are redirected to the circulation.pl page for the user and that an error message is there. OPAC SIDE 6) Go to the OPAC 7) Go to /cgi-bin/koha/opac-discharge.pl 8) Confirm you get a message saying discharges are disabled 9) Go to /cgi-bin/koha/opac-discharge.pl?op=request 10) Confirm you see same message Sponsored-by: Catalyst IT Followed test plan, works as expected (both staff client and OPAC). Signed-off-by: Marc Véron <veron@veron.ch>
Comment on attachment 50707 [details] [review] Bug 15823: Can still access patron discharge slip without having the syspref on Review of attachment 50707 [details] [review]: ----------------------------------------------------------------- 10/ Yes I see the message, but the discharge has been requested anyway. You have to redirect to a 404 in case of opac-discharge.pl is called with the op parameter set. ::: members/discharge.pl @@ +55,5 @@ > + > +unless ( C4::Context->preference('useDischarge') ) { > + print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber&nopermission=1"); > + exit; > +} else { The else is not needed. You are exiting the script in case of the pref is on.
(In reply to Jonathan Druart from comment #10) > The else is not needed. You are exiting the script in case of the pref is on. In case of the pref is off of course...
See comment#10 and comment#11!
Created attachment 50771 [details] [review] Bug 15823: Can still access patron discharge slip without having the syspref on EDIT: Fix for OPAC side EDIT: Comment 10 To test: 1) Ensure syspref useDischarge is disabled 2) Go to /cgi-bin/koha/members/discharge.pl?borrowernumber=X&discharge=1 3) Validate that you are still able to generate a discharge slip for this patron 4) Apply patch and refresh page 5) Confirm that you are redirected to the circulation.pl page for the user and that an error message is there. OPAC SIDE 6) Go to the OPAC 7) Go to /cgi-bin/koha/opac-discharge.pl 8) Confirm you get a message saying discharges are disabled 9) Go to /cgi-bin/koha/opac-discharge.pl?op=request 10) Confirm you see same message Sponsored-by: Catalyst IT Followed test plan, works as expected (both staff client and OPAC). Signed-off-by: Marc Véron <veron@veron.ch>
Sorry, does not apply on current master. Auto-merging koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt CONFLICT (content): Merge conflict in koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt Auto-merging circ/circulation.pl CONFLICT (content): Merge conflict in circ/circulation.pl Failed to merge in the changes.
Created attachment 51121 [details] [review] Bug 15823: Can still access patron discharge slip without having the syspref on EDIT: Fix for OPAC side EDIT: Comment 10 EDIT: Merge conflicts To test: 1) Ensure syspref useDischarge is disabled 2) Go to /cgi-bin/koha/members/discharge.pl?borrowernumber=X&discharge=1 3) Validate that you are still able to generate a discharge slip for this patron 4) Apply patch and refresh page 5) Confirm that you are redirected to the circulation.pl page for the user and that an error message is there. OPAC SIDE 6) Go to the OPAC 7) Go to /cgi-bin/koha/opac-discharge.pl 8) Confirm you get a message saying discharges are disabled 9) Go to /cgi-bin/koha/opac-discharge.pl?op=request 10) Confirm you see same message Sponsored-by: Catalyst IT Followed test plan, works as expected (both staff client and OPAC). Signed-off-by: Marc Véron <veron@veron.ch>
Created attachment 51133 [details] [review] Bug 15823: Can still access patron discharge slip without having the syspref on EDIT: Fix for OPAC side EDIT: Comment 10 EDIT: Merge conflicts To test: 1) Ensure syspref useDischarge is disabled 2) Go to /cgi-bin/koha/members/discharge.pl?borrowernumber=X&discharge=1 3) Validate that you are still able to generate a discharge slip for this patron 4) Apply patch and refresh page 5) Confirm that you are redirected to the circulation.pl page for the user and that an error message is there. OPAC SIDE 6) Go to the OPAC 7) Go to /cgi-bin/koha/opac-discharge.pl 8) Confirm you get a message saying discharges are disabled 9) Go to /cgi-bin/koha/opac-discharge.pl?op=request 10) Confirm you see same message Sponsored-by: Catalyst IT Followed test plan, works as expected (both staff client and OPAC). Re-tested, works OK. Signed-off-by: Marc Véron <veron@veron.ch>
(In reply to Jonathan Druart from comment #10) > 10/ Yes I see the message, but the discharge has been requested anyway. > You have to redirect to a 404 in case of opac-discharge.pl is called with > the op parameter set. And what about the redirect at the OPAC? Switch to signoff when you will submit a follow-up.
Created attachment 51229 [details] [review] [FOLLOW-UP] Bug 15823: Redirect opac-discharge.pl to 404 page See comment #17: Redirect to 404 in opac-discharge.pl and remove message in template because with the redirect it will never be reached.
Reset to Signed Off (see comment 17)
Created attachment 51268 [details] [review] [PASSED QA] Bug 15823: Can still access patron discharge slip without having the syspref on EDIT: Fix for OPAC side EDIT: Comment 10 EDIT: Merge conflicts To test: 1) Ensure syspref useDischarge is disabled 2) Go to /cgi-bin/koha/members/discharge.pl?borrowernumber=X&discharge=1 3) Validate that you are still able to generate a discharge slip for this patron 4) Apply patch and refresh page 5) Confirm that you are redirected to the circulation.pl page for the user and that an error message is there. OPAC SIDE 6) Go to the OPAC 7) Go to /cgi-bin/koha/opac-discharge.pl 8) Confirm you get a message saying discharges are disabled 9) Go to /cgi-bin/koha/opac-discharge.pl?op=request 10) Confirm you see same message Sponsored-by: Catalyst IT Followed test plan, works as expected (both staff client and OPAC). Re-tested, works OK. Signed-off-by: Marc Véron <veron@veron.ch> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 51269 [details] [review] [PASSED QA] Bug 15823: Redirect opac-discharge.pl to 404 page See comment #17: Redirect to 404 in opac-discharge.pl and remove message in template because with the redirect it will never be reached. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Pushed to Master - Should be in the May 2016 Release. Thanks!
Patches pushed to 3.22.x, will be in 3.22.7
Created attachment 51750 [details] [review] Bug 15823: Force scalar context CGI->param must not be called in list context
@RM & Rmaint, please push the follow-up.
(In reply to Jonathan Druart from comment #25) > @RM & Rmaint, please push the follow-up. Looks like 3.22.7 and 16.05.0 got released in the meantime, without the last follow-up. There are 2 (now 3) branches affected by this issue; for 3.22.x branch, there is a patch in Bug 16646. Because Bug 15823 and Bug 9393 got pushed into master & 3.22.7 in different order, symptoms and severity of this issue are different in both branches. Not sure what would be better: to have two separate bug reports, for 3.22 and master (to be backported for 16.05), or a single report for master only (to be backported for 3.22 and 16.05)?
Comment on attachment 51750 [details] [review] Bug 15823: Force scalar context Moved to bug 16670.