Bugzilla – Attachment 106826 Details for
Bug 23634
Privilege escalation vulnerability for staff users with 'edit_borrowers' permission and 'OpacResetPassword' enabled
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 23634: (QA follow-up) Adjust tests
Bug-23634-QA-follow-up-Adjust-tests.patch (text/plain), 4.92 KB, created by
Nick Clemens (kidclamp)
on 2020-07-13 10:33:31 UTC
(
hide
)
Description:
Bug 23634: (QA follow-up) Adjust tests
Filename:
MIME Type:
Creator:
Nick Clemens (kidclamp)
Created:
2020-07-13 10:33:31 UTC
Size:
4.92 KB
patch
obsolete
>From fb440d27146a2fc904d587898cafeaa9961fcee2 Mon Sep 17 00:00:00 2001 >From: Nick Clemens <nick@bywatersolutions.com> >Date: Mon, 13 Jul 2020 10:33:11 +0000 >Subject: [PATCH] Bug 23634: (QA follow-up) Adjust tests > >--- > t/db_dependent/api/v1/patrons.t | 30 +++++++++++++++++++++--------- > 1 file changed, 21 insertions(+), 9 deletions(-) > >diff --git a/t/db_dependent/api/v1/patrons.t b/t/db_dependent/api/v1/patrons.t >index 8a2295865b..8d99f5ea81 100644 >--- a/t/db_dependent/api/v1/patrons.t >+++ b/t/db_dependent/api/v1/patrons.t >@@ -222,7 +222,7 @@ subtest 'update() tests' => sub { > $schema->storage->txn_rollback; > > subtest 'librarian access tests' => sub { >- plan tests => 40; >+ plan tests => 42; > > $schema->storage->txn_begin; > >@@ -340,6 +340,10 @@ subtest 'update() tests' => sub { > $newpatron->{cardnumber} = $superlibrarian->cardnumber; > $newpatron->{userid} = $superlibrarian->userid; > $newpatron->{email} = 'nosense@no.no'; >+ # delete RO attributes >+ delete $newpatron->{patron_id}; >+ delete $newpatron->{restricted}; >+ delete $newpatron->{anonymized}; > > # attempt to update > $authorized_patron->flags( 2**4 )->store; # borrowers flag = 4 >@@ -350,8 +354,8 @@ subtest 'update() tests' => sub { > # attempt to unset > $newpatron->{email} = undef; > $t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron ) >- ->status_is(403, "Non-superlibrarian user change of superlibrarian email forbidden") >- ->json_is( { error => "Not enough privileges to change a superlibrarian's email to undefined" } ); >+ ->status_is(403, "Non-superlibrarian user change of superlibrarian email to undefined forbidden") >+ ->json_is( { error => "Not enough privileges to change a superlibrarian's email" } ); > > $newpatron->{email} = $superlibrarian->email; > $newpatron->{secondary_email} = 'nonsense@no.no'; >@@ -359,13 +363,13 @@ subtest 'update() tests' => sub { > # attempt to update > $t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron ) > ->status_is(403, "Non-superlibrarian user change of superlibrarian secondary_email forbidden") >- ->json_is( { error => "Not enough privileges to change a superlibrarian's secondary_email" } ); >+ ->json_is( { error => "Not enough privileges to change a superlibrarian's email" } ); > > # attempt to unset > $newpatron->{secondary_email} = undef; > $t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron ) >- ->status_is(403, "Non-superlibrarian user change of superlibrarian secondary_email forbidden") >- ->json_is( { error => "Not enough privileges to change a superlibrarian's secondary_email to undefined" } ); >+ ->status_is(403, "Non-superlibrarian user change of superlibrarian secondary_email to undefined forbidden") >+ ->json_is( { error => "Not enough privileges to change a superlibrarian's email" } ); > > $newpatron->{secondary_email} = $superlibrarian->emailpro; > $newpatron->{altaddress_email} = 'nonsense@no.no'; >@@ -373,13 +377,21 @@ subtest 'update() tests' => sub { > # attempt to update > $t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron ) > ->status_is(403, "Non-superlibrarian user change of superlibrarian altaddress_email forbidden") >- ->json_is( { error => "Not enough privileges to change a superlibrarian's altaddress_email" } ); >+ ->json_is( { error => "Not enough privileges to change a superlibrarian's email" } ); > > # attempt to unset > $newpatron->{altaddress_email} = undef; > $t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron ) >- ->status_is(403, "Non-superlibrarian user change of superlibrarian altaddress_email forbidden") >- ->json_is( { error => "Not enough privileges to change a superlibrarian's altaddress_email to undefined" } ); >+ ->status_is(403, "Non-superlibrarian user change of superlibrarian altaddress_email to undefined forbidden") >+ ->json_is( { error => "Not enough privileges to change a superlibrarian's email" } ); >+ >+ # update patron without sending email >+ delete $newpatron->{email}; >+ delete $newpatron->{secondary_email}; >+ delete $newpatron->{altaddress_email}; >+ $t->put_ok( "//$userid:$password@/api/v1/patrons/" . $superlibrarian->borrowernumber => json => $newpatron ) >+ ->status_is(200, "Non-superlibrarian user can edit superlibrarian successfully if not changing email"); >+# ->json_is( { error => "Not enough privileges to change a superlibrarian's email" } ); > > $schema->storage->txn_rollback; > }; >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 23634
:
92932
|
92998
|
95563
|
95564
|
95574
|
95575
|
95576
|
95577
|
95582
|
97986
|
97987
|
97988
|
97989
|
97990
|
106159
|
106160
|
106161
|
106162
|
106163
|
106723
|
106724
|
106725
|
106726
|
106727
|
106764
|
106826
|
106837
|
106838
|
106839
|
106840
|
106841
|
106842
|
106843
|
106844
|
106979
|
106980
|
106981
|
106982
|
106983
|
106984
|
106985
|
106986
|
109582