Bug 31893 - Some pages load about.tt template to check authentication rather than using checkauth
Summary: Some pages load about.tt template to check authentication rather than using c...
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Nick Clemens
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-10-20 15:33 UTC by Nick Clemens
Modified: 2023-12-28 20:44 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.05.00,22.11.03,22.05.10, 21.11.16


Attachments
Bug 31893: Use checkauth and do not fetch about.tt template (4.48 KB, patch)
2023-01-13 17:32 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 31893: Use checkauth and do not fetch about.tt template (4.53 KB, patch)
2023-01-17 23:38 UTC, David Nind
Details | Diff | Splinter Review
Bug 31893: Use checkauth and do not fetch about.tt template (4.60 KB, patch)
2023-01-19 11:11 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens 2022-10-20 15:33:54 UTC
It seems to be an old hack, where the about template is used to check auth for pages that don't actually render. These must all be updated to use checkauth

reserve/modrequest.pl
reserve/modrequest_suspendall.pl
course_reserves/mod_course.pl
members/members-update-do.pl
Comment 1 Jonathan Druart 2022-10-20 15:50:22 UTC
how did I never notice that?!
Comment 2 Nick Clemens 2023-01-13 17:32:10 UTC
Created attachment 145297 [details] [review]
Bug 31893: Use checkauth and do not fetch about.tt template

This patch updates four scripts to use checkauth instead of get_template_and_user

reserve/modrequest.pl
reserve/modrequest_suspendall.pl
course_reserves/mod_course.pl
members/members-update-do.pl

No behvaiour change is expected

To test:
0 - Apply patch
1 - Place some holds for a patron
2 - From patron page, confirm you can suspend all
3 - confirm you can delete marked holds
4 - Edit a course in course-reserves
5 - Make a chaneg to personal details via OPAC
6 - Confirm change can be approved on staff side
Comment 3 David Cook 2023-01-16 00:25:08 UTC
Yeah... nice catch! 

I think there used to be more auth logic in get_template_and_user() hence the hack, but yeah... wow.
Comment 4 David Nind 2023-01-17 23:38:55 UTC
Created attachment 145378 [details] [review]
Bug 31893: Use checkauth and do not fetch about.tt template

This patch updates four scripts to use checkauth instead of get_template_and_user

reserve/modrequest.pl
reserve/modrequest_suspendall.pl
course_reserves/mod_course.pl
members/members-update-do.pl

No behvaiour change is expected

To test:
0 - Apply patch
1 - Place some holds for a patron
2 - From patron page, confirm you can suspend all
3 - confirm you can delete marked holds
4 - Edit a course in course-reserves
5 - Make a chaneg to personal details via OPAC
6 - Confirm change can be approved on staff side

Signed-off-by: David Nind <david@davidnind.com>
Comment 5 Martin Renvoize 2023-01-19 11:11:41 UTC
Created attachment 145456 [details] [review]
Bug 31893: Use checkauth and do not fetch about.tt template

This patch updates four scripts to use checkauth instead of get_template_and_user

reserve/modrequest.pl
reserve/modrequest_suspendall.pl
course_reserves/mod_course.pl
members/members-update-do.pl

No behvaiour change is expected

To test:
0 - Apply patch
1 - Place some holds for a patron
2 - From patron page, confirm you can suspend all
3 - confirm you can delete marked holds
4 - Edit a course in course-reserves
5 - Make a chaneg to personal details via OPAC
6 - Confirm change can be approved on staff side

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 6 Martin Renvoize 2023-01-19 11:12:21 UTC
Nice bit of cleanup.. Passing QA
Comment 7 Martin Renvoize 2023-01-20 13:57:15 UTC
Keep up the good work!

Pushed to 23.05.x for the next release
Comment 8 Matt Blenkinsop 2023-01-31 14:10:10 UTC
Nice work everyone!

Pushed to stable for 22.11.x
Comment 9 Lucas Gass 2023-02-01 15:49:46 UTC
Backported to 22.05.x for upcoming 22.05.10
Comment 10 Arthur Suzuki 2023-02-16 14:57:21 UTC
applied to 21.11.x for 21.11.16