Bugzilla – Attachment 107768 Details for
Bug 26023
Incorrect permissions handling for cashup actions on the library level registers summary page
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 26023: Properly secure the cashup and refund actions
Bug-26023-Properly-secure-the-cashup-and-refund-ac.patch (text/plain), 5.45 KB, created by
Martin Renvoize (ashimema)
on 2020-08-04 14:09:29 UTC
(
hide
)
Description:
Bug 26023: Properly secure the cashup and refund actions
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2020-08-04 14:09:29 UTC
Size:
5.45 KB
patch
obsolete
>From 3991f2a177a14746570d7d5e9e1afa13026b0b47 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Tue, 4 Aug 2020 15:02:03 +0100 >Subject: [PATCH] Bug 26023: Properly secure the cashup and refund actions > >The cash register summary page for cash management is available for users >with the 'anonymous_refund' or 'cashup' permission and the actions available >are appropriately displayed. > >However, the actions are not yet correctly tested for at the server and >so a user may force submit to accomplish the action. >--- > .../prog/en/modules/pos/register.tt | 12 +++ > pos/register.pl | 84 +++++++++++-------- > 2 files changed, 59 insertions(+), 37 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt >index 2d96682a2f..035c9780c9 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt >@@ -28,6 +28,18 @@ > </div> > [% ELSE %] > >+ [% IF ( error_cashup_permission ) %] >+ <div id="error_message" class="dialog alert"> >+ You do not have permission to perform cashup actions. >+ </div> >+ [% END %] >+ >+ [% IF ( error_refund_permission ) %] >+ <div id="error_message" class="dialog alert"> >+ You do not have permission to perform refund actions. >+ </div> >+ [% END %] >+ > [% IF ( CAN_user_cash_management_cashup ) %] > <div id="toolbar" class="btn-toolbar"> > <button id="pos_cashup" type="button" class="btn btn-default" data-toggle="modal" data-target="#confirmCashupModal" ><i class="fa fa-money"></i> Record cashup</button> >diff --git a/pos/register.pl b/pos/register.pl >index ada83c470f..b2606049d0 100755 >--- a/pos/register.pl >+++ b/pos/register.pl >@@ -102,45 +102,55 @@ else { > > my $op = $input->param('op') // ''; > if ( $op eq 'cashup' ) { >- $cash_register->add_cashup( >- { >- manager_id => $logged_in_user->id, >- amount => $cash_register->outstanding_accountlines->total >- } >- ); >+ if ( $logged_in_user->has_permission( { cash_management => 'cashup' } ) ) { >+ $cash_register->add_cashup( >+ { >+ manager_id => $logged_in_user->id, >+ amount => $cash_register->outstanding_accountlines->total >+ } >+ ); >+ } >+ else { >+ $template->param( error_cashup_permission => 1 ); >+ } > } > elsif ( $op eq 'refund' ) { >- my $amount = $input->param('amount'); >- my $quantity = $input->param('quantity'); >- my $accountline_id = $input->param('accountline'); >- my $transaction_type = $input->param('transaction_type'); >- >- my $accountline = Koha::Account::Lines->find($accountline_id); >- $schema->txn_do( >- sub { >- >- my $refund = $accountline->reduce( >- { >- reduction_type => 'Refund', >- branch => $library_id, >- staff_id => $logged_in_user->id, >- interface => 'intranet', >- amount => $amount >- } >- ); >- my $payout = $refund->payout( >- { >- payout_type => $transaction_type, >- branch => $library_id, >- staff_id => $logged_in_user->id, >- cash_register => $cash_register->id, >- interface => 'intranet', >- amount => $amount >- } >- ); >- >- } >- ); >+ if ( $logged_in_user->has_permission( { cash_management => 'anonymous_refund' } ) ) { >+ my $amount = $input->param('amount'); >+ my $quantity = $input->param('quantity'); >+ my $accountline_id = $input->param('accountline'); >+ my $transaction_type = $input->param('transaction_type'); >+ >+ my $accountline = Koha::Account::Lines->find($accountline_id); >+ $schema->txn_do( >+ sub { >+ >+ my $refund = $accountline->reduce( >+ { >+ reduction_type => 'Refund', >+ branch => $library_id, >+ staff_id => $logged_in_user->id, >+ interface => 'intranet', >+ amount => $amount >+ } >+ ); >+ my $payout = $refund->payout( >+ { >+ payout_type => $transaction_type, >+ branch => $library_id, >+ staff_id => $logged_in_user->id, >+ cash_register => $cash_register->id, >+ interface => 'intranet', >+ amount => $amount >+ } >+ ); >+ >+ } >+ ); >+ } >+ else { >+ $template->param( error_refund_permission => 1 ); >+ } > } > } > >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 26023
:
107081
|
107082
|
107767
|
107768
|
108171
|
108172
|
108772
|
108773