Bugzilla – Attachment 107081 Details for
Bug 26023
Incorrect permissions handling for cashup actions on the library level registers summary page
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 26023: Properly secure the cashup action for libraries
Bug-26023-Properly-secure-the-cashup-action-for-li.patch (text/plain), 5.63 KB, created by
Martin Renvoize (ashimema)
on 2020-07-20 08:51:22 UTC
(
hide
)
Description:
Bug 26023: Properly secure the cashup action for libraries
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2020-07-20 08:51:22 UTC
Size:
5.63 KB
patch
obsolete
>From 8f66f1037ed0faf7f1d875fd2fa7e530eebaeffc Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Mon, 20 Jul 2020 09:44:05 +0100 >Subject: [PATCH] Bug 26023: Properly secure the cashup action for libraries > >The libraries summary page for cash management is available for users >wit the 'anonymous_refund' permission to allow them to navigate to >alternate cash registers and search for the prior transaction to refund. > >However, currently the cashup option appears, and is not blocked at the >server, for all user who may access the page. It should be blocked for >those users without the 'cashup' permission. >--- > .../prog/en/modules/pos/registers.tt | 16 +++++++++- > pos/registers.pl | 29 +++++++++++-------- > 2 files changed, 32 insertions(+), 13 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt >index 026dd1c9fa..3233eafae6 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt >@@ -25,6 +25,11 @@ > can record payments. > </div> > [% ELSE %] >+ [% IF ( error_cashup_permission ) %] >+ <div id="error_message" class="dialog alert"> >+ You do not have permission to perform cashup actions. >+ </div> >+ [% END %] > <div id="toolbar" class="btn-toolbar"> > <button type="button" class="cashup_all btn btn-default" data-toggle="modal" data-target="#confirmCashupAllModal"><i class="fa fa-money"></i> Cashup all</button> > </div> >@@ -47,7 +52,9 @@ > <th>Bankable</th> > <th>Income (cash)</th> > <th>Outgoing (cash)</th> >+ [% IF CAN_user_cash_management_cashup %] > <th>Actions</th> >+ [% END %] > </thead> > <tbody> > [% SET bankable = 0, ctotal = 0, dtotal = 0, cctotal = 0, cdtotal = 0 %] >@@ -81,9 +88,12 @@ > [% rdtotal | $Price %] ([% rcdtotal | $Price %]) > [% SET dtotal = dtotal + rdtotal %] > [% SET cdtotal = cdtotal + rcdtotal %] >+ </td> >+ [% IF CAN_user_cash_management_cashup %] > <td> > <button type="button" class="cashup_individual btn btn-default" data-toggle="modal" data-target="#confirmCashupModal" data-register="[% register.description | html %]" data-bankable="[% rbankable | $Price %]" data-float="[% register.starting_float | $Price %]" data-registerid="[% register.id | html %]"><i class="fa fa-money"></i> Record cashup</button> > </td> >+ [% END %] > </tr> > [% END %] > </tbody> >@@ -93,7 +103,11 @@ > <td>[% bankable | $Price %]</td> > <td>[% ctotal | $Price %] ([% cctotal | $Price %])</td> > <td>[% dtotal | $Price %] ([% cdtotal | $Price %])</td> >- <td><button type="button" class="cashup_all btn btn-default" data-toggle="modal" data-target="#confirmCashupAllModal"><i class="fa fa-money"></i> Cashup all</button></td> >+ [% IF CAN_user_cash_management_cashup %] >+ <td> >+ <button type="button" class="cashup_all btn btn-default" data-toggle="modal" data-target="#confirmCashupAllModal"><i class="fa fa-money"></i> Cashup all</button> >+ </td> >+ [% END %] > </tr> > </tfoot> > </table> >diff --git a/pos/registers.pl b/pos/registers.pl >index 620b45dbab..c644ebc585 100755 >--- a/pos/registers.pl >+++ b/pos/registers.pl >@@ -55,18 +55,10 @@ else { > > my $op = $input->param('op') // ''; > if ( $op eq 'cashup' ) { >- my $registerid = $input->param('registerid'); >- if ($registerid) { >- my $register = Koha::Cash::Registers->find( { id => $registerid } ); >- $register->add_cashup( >- { >- manager_id => $logged_in_user->id, >- amount => $register->outstanding_accountlines->total >- } >- ); >- } >- else { >- for my $register ( $registers->as_list ) { >+ if ( $logged_in_user->has_permission( { cash_management => 'cashup' } ) ) { >+ my $registerid = $input->param('registerid'); >+ if ($registerid) { >+ my $register = Koha::Cash::Registers->find( { id => $registerid } ); > $register->add_cashup( > { > manager_id => $logged_in_user->id, >@@ -74,6 +66,19 @@ if ( $op eq 'cashup' ) { > } > ); > } >+ else { >+ for my $register ( $registers->as_list ) { >+ $register->add_cashup( >+ { >+ manager_id => $logged_in_user->id, >+ amount => $register->outstanding_accountlines->total >+ } >+ ); >+ } >+ } >+ } >+ else { >+ $template->param( error_cashup_permission => 1 ); > } > } > >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 26023
:
107081
|
107082
|
107767
|
107768
|
108171
|
108172
|
108772
|
108773