It seems to be an old hack, where the about template is used to check auth for pages that don't actually render. These must all be updated to use checkauth reserve/modrequest.pl reserve/modrequest_suspendall.pl course_reserves/mod_course.pl members/members-update-do.pl
how did I never notice that?!
Created attachment 145297 [details] [review] Bug 31893: Use checkauth and do not fetch about.tt template This patch updates four scripts to use checkauth instead of get_template_and_user reserve/modrequest.pl reserve/modrequest_suspendall.pl course_reserves/mod_course.pl members/members-update-do.pl No behvaiour change is expected To test: 0 - Apply patch 1 - Place some holds for a patron 2 - From patron page, confirm you can suspend all 3 - confirm you can delete marked holds 4 - Edit a course in course-reserves 5 - Make a chaneg to personal details via OPAC 6 - Confirm change can be approved on staff side
Yeah... nice catch! I think there used to be more auth logic in get_template_and_user() hence the hack, but yeah... wow.
Created attachment 145378 [details] [review] Bug 31893: Use checkauth and do not fetch about.tt template This patch updates four scripts to use checkauth instead of get_template_and_user reserve/modrequest.pl reserve/modrequest_suspendall.pl course_reserves/mod_course.pl members/members-update-do.pl No behvaiour change is expected To test: 0 - Apply patch 1 - Place some holds for a patron 2 - From patron page, confirm you can suspend all 3 - confirm you can delete marked holds 4 - Edit a course in course-reserves 5 - Make a chaneg to personal details via OPAC 6 - Confirm change can be approved on staff side Signed-off-by: David Nind <david@davidnind.com>
Created attachment 145456 [details] [review] Bug 31893: Use checkauth and do not fetch about.tt template This patch updates four scripts to use checkauth instead of get_template_and_user reserve/modrequest.pl reserve/modrequest_suspendall.pl course_reserves/mod_course.pl members/members-update-do.pl No behvaiour change is expected To test: 0 - Apply patch 1 - Place some holds for a patron 2 - From patron page, confirm you can suspend all 3 - confirm you can delete marked holds 4 - Edit a course in course-reserves 5 - Make a chaneg to personal details via OPAC 6 - Confirm change can be approved on staff side Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Nice bit of cleanup.. Passing QA
Keep up the good work! Pushed to 23.05.x for the next release
Nice work everyone! Pushed to stable for 22.11.x
Backported to 22.05.x for upcoming 22.05.10
applied to 21.11.x for 21.11.16
*** Bug 30732 has been marked as a duplicate of this bug. ***