It seems that opac-article-request-cancel.pl doesn't check that the article request to be cancelled actually belongs to the logged-in borrower. This results in any logged-in user being able to cancel any article request just by changing the id in the URL.
Created attachment 85137 [details] [review] Bug 22068: Prevent patrons to cancel article request they did not create opac-article-request-cancel.pl doesn't check that the article request to be cancelled actually belongs to the logged-in borrower. This results in any logged-in user being able to cancel any article request just by changing the id in the URL. Test plan: - Login with Patron P1, create an article request - Cancel it - Create another one - Copy the cancellation link (must be /cgi-bin/koha/opac-article-request-cancel.pl?id=X) - Login with Patron P2 - Hit the cancellation link => Without this patch the article request is cancelled => With this patch applied there is a 404 redirection Note that the 404 will also appears when the article request id does not exist.
Created attachment 87438 [details] [review] Bug 22068: Prevent patrons to cancel article request they did not create opac-article-request-cancel.pl doesn't check that the article request to be cancelled actually belongs to the logged-in borrower. This results in any logged-in user being able to cancel any article request just by changing the id in the URL. Test plan: - Login with Patron P1, create an article request - Cancel it - Create another one - Copy the cancellation link (must be /cgi-bin/koha/opac-article-request-cancel.pl?id=X) - Login with Patron P2 - Hit the cancellation link => Without this patch the article request is cancelled => With this patch applied there is a 404 redirection Note that the 404 will also appears when the article request id does not exist. Signed-off-by: Ere Maijala <ere.maijala@helsinki.fi>
Created attachment 87460 [details] [review] Bug 22068: Prevent patrons to cancel article request they did not create opac-article-request-cancel.pl doesn't check that the article request to be cancelled actually belongs to the logged-in borrower. This results in any logged-in user being able to cancel any article request just by changing the id in the URL. Test plan: - Login with Patron P1, create an article request - Cancel it - Create another one - Copy the cancellation link (must be /cgi-bin/koha/opac-article-request-cancel.pl?id=X) - Login with Patron P2 - Hit the cancellation link => Without this patch the article request is cancelled => With this patch applied there is a 404 redirection Note that the 404 will also appears when the article request id does not exist. Signed-off-by: Ere Maijala <ere.maijala@helsinki.fi> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Created attachment 87461 [details] [review] Bug 22068: (QA follow-up) Return meaningful error codes Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Awesome work all! Pushed to master for 19.05
Pushed to 18.11.x for 18.11.05
backported to 18.05.x for 18.05.12
Pushed to 17.11.x for 17.11.18