Bug 17423 - patronimage.pl permission is too restrictive
Summary: patronimage.pl permission is too restrictive
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: Main
Hardware: All All
: P5 - low minor (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
: 17325 (view as bug list)
Depends on: 14566
Blocks: 29541
  Show dependency treegraph
 
Reported: 2016-10-11 07:59 UTC by Fridolin Somers
Modified: 2021-11-22 14:04 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 17423 - patronimage.pl permission is too restrictive (1.29 KB, patch)
2016-10-11 08:07 UTC, Fridolin Somers
Details | Diff | Splinter Review
Bug 17423 - patronimage.pl permission is too restrictive (1.35 KB, patch)
2016-10-11 08:35 UTC, Fridolin Somers
Details | Diff | Splinter Review
Bug 17423 - patronimage.pl permission is too restrictive (1.39 KB, patch)
2016-10-11 09:34 UTC, Fridolin Somers
Details | Diff | Splinter Review
Bug 17423 - patronimage.pl permission is too restrictive (1.43 KB, patch)
2016-10-11 10:31 UTC, Biblibre Sandboxes
Details | Diff | Splinter Review
Bug 17423 - patronimage.pl permission is too restrictive (1.51 KB, patch)
2016-10-12 14:18 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Fridolin Somers 2016-10-11 07:59:05 UTC
Bug 14566 added the permission "borrowers" on patronimage.pl.
This perm is too restrictive because circulation pages also uses this page.

I propose to simply use "catalogue" perm.
Comment 1 Fridolin Somers 2016-10-11 08:07:52 UTC
Created attachment 56134 [details] [review]
Bug 17423 - patronimage.pl permission is too restrictive

Bug 14566 added the permission "borrowers" on patronimage.pl.
This perm is too restrictive because circulation pages also uses this page.

I propose to simply use "catalogue" perm.

Test plan
- Set an image to borrower xx
- Create a user with only catalogue permission
- Log with this user
- Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx
=> Without patch you get 403 error
=> With patch you get the image
Comment 2 Fridolin Somers 2016-10-11 08:09:40 UTC
*** Bug 17325 has been marked as a duplicate of this bug. ***
Comment 3 Fridolin Somers 2016-10-11 08:35:52 UTC
Created attachment 56136 [details] [review]
Bug 17423 - patronimage.pl permission is too restrictive

Bug 14566 added the permission "borrowers" on patronimage.pl.
This perm is too restrictive because circulation pages also uses this page.

I propose to simply use "catalogue" perm.

Test plan
- Set an image to borrower xx
- Create a user with only catalogue permission
- Log with this user
- Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx
=> Without patch you get 403 error
=> With patch you get the image
- Log out and test the page patronimage.pl
=> You get 403 error
Comment 4 Fridolin Somers 2016-10-11 09:34:03 UTC
Created attachment 56150 [details] [review]
Bug 17423 - patronimage.pl permission is too restrictive

Bug 14566 added the permission "borrowers" on patronimage.pl.
This perm is too restrictive because circulation pages also uses this page.

I propose to simply use "catalogue" perm.

Test plan
- Set an image to borrower xx
- Create a user with only catalogue permission
- Log with this user
- Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx
=> Without patch you get the page saying you do not have the permission
=> With patch you get the image
- Log out and retest the page patronimage.pl
=> You get 403 error
Comment 5 Biblibre Sandboxes 2016-10-11 10:03:10 UTC
Patch tested with a sandbox, by remy <remy.gonzalves@iepg.fr>
Comment 6 Biblibre Sandboxes 2016-10-11 10:31:58 UTC
Created attachment 56166 [details] [review]
Bug 17423 - patronimage.pl permission is too restrictive

Bug 14566 added the permission "borrowers" on patronimage.pl.
This perm is too restrictive because circulation pages also uses this page.

I propose to simply use "catalogue" perm.

Test plan
- Set an image to borrower xx
- Create a user with only catalogue permission
- Log with this user
- Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx
=> Without patch you get the page saying you do not have the permission
=> With patch you get the image
- Log out and retest the page patronimage.pl
=> You get 403 error

Signed-off-by: remy <remy.gonzalves@iepg.fr>
Comment 7 Jonathan Druart 2016-10-12 14:18:15 UTC
Created attachment 56289 [details] [review]
Bug 17423 - patronimage.pl permission is too restrictive

Bug 14566 added the permission "borrowers" on patronimage.pl.
This perm is too restrictive because circulation pages also uses this page.

I propose to simply use "catalogue" perm.

Test plan
- Set an image to borrower xx
- Create a user with only catalogue permission
- Log with this user
- Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx
=> Without patch you get the page saying you do not have the permission
=> With patch you get the image
- Log out and retest the page patronimage.pl
=> You get 403 error

Signed-off-by: remy <remy.gonzalves@iepg.fr>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 8 Brendan Gallagher 2016-10-17 23:46:32 UTC
Pushed to Master - Should be in the November 16.11 Release.  Thanks!
Comment 9 Frédéric Demians 2016-10-22 12:51:54 UTC
Pushed in 16.05. Will be in 16.05.05.
Comment 10 Julian Maurice 2016-10-24 10:34:09 UTC
Pushed in 3.22.x, will be in 3.22.12