Bugzilla – Attachment 106727 Details for
Bug 23634
Privilege escalation vulnerability for staff users with 'edit_borrowers' permission and 'OpacResetPassword' enabled
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 23634: (follow-up) Prevent updates on POST
Bug-23634-follow-up-Prevent-updates-on-POST.patch (text/plain), 1008 bytes, created by
Martin Renvoize (ashimema)
on 2020-07-09 14:58:15 UTC
(
hide
)
Description:
Bug 23634: (follow-up) Prevent updates on POST
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2020-07-09 14:58:15 UTC
Size:
1008 bytes
patch
obsolete
>From 4c369e99fb5c3592c6a0a56e4ac026d9e173de9c Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Tue, 19 Nov 2019 16:59:06 +0000 >Subject: [PATCH] Bug 23634: (follow-up) Prevent updates on POST > >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > members/memberentry.pl | 7 +++++++ > 1 file changed, 7 insertions(+) > >diff --git a/members/memberentry.pl b/members/memberentry.pl >index eb6d63d208..0bbb8422af 100755 >--- a/members/memberentry.pl >+++ b/members/memberentry.pl >@@ -526,6 +526,13 @@ if ((!$nok) and $nodouble and ($op eq 'insert' or $op eq 'save')){ > } > > $patron = Koha::Patrons->find( $borrowernumber ); >+ >+ if ($NoUpdateEmail) { >+ delete $newdata{'email'}; >+ delete $newdata{'emailpro'}; >+ delete $newdata{'B_email'}; >+ } >+ > $newdata{debarredcomment} = $newdata{debarred_comment}; > delete $newdata{debarred_comment}; > delete $newdata{password2}; >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 23634
:
92932
|
92998
|
95563
|
95564
|
95574
|
95575
|
95576
|
95577
|
95582
|
97986
|
97987
|
97988
|
97989
|
97990
|
106159
|
106160
|
106161
|
106162
|
106163
|
106723
|
106724
|
106725
|
106726
|
106727
|
106764
|
106826
|
106837
|
106838
|
106839
|
106840
|
106841
|
106842
|
106843
|
106844
|
106979
|
106980
|
106981
|
106982
|
106983
|
106984
|
106985
|
106986
|
109582