Bugzilla – Attachment 108772 Details for
Bug 26023
Incorrect permissions handling for cashup actions on the library level registers summary page
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 26023: Properly secure the cashup action for libraries
Bug-26023-Properly-secure-the-cashup-action-for-li.patch (text/plain), 5.95 KB, created by
Katrin Fischer
on 2020-08-20 23:10:12 UTC
(
hide
)
Description:
Bug 26023: Properly secure the cashup action for libraries
Filename:
MIME Type:
Creator:
Katrin Fischer
Created:
2020-08-20 23:10:12 UTC
Size:
5.95 KB
patch
obsolete
>From 557e561755e5b7adebd651df8244a891df4f5723 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Mon, 20 Jul 2020 09:44:05 +0100 >Subject: [PATCH] Bug 26023: Properly secure the cashup action for libraries > >The libraries summary page for cash management is available for users >wit the 'anonymous_refund' permission to allow them to navigate to >alternate cash registers and search for the prior transaction to refund. > >However, currently the cashup option appears, and is not blocked at the >server, for all user who may access the page. It should be blocked for >those users without the 'cashup' permission. > >Signed-off-by: Nick Clemens <nick@bywatersolutions.com> > >Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> >--- > .../intranet-tmpl/prog/en/modules/pos/registers.tt | 20 ++++++++++++++- > pos/registers.pl | 29 +++++++++++++--------- > 2 files changed, 36 insertions(+), 13 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt >index 4e373fc104..65f593a1dc 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt >@@ -32,9 +32,18 @@ > [% END %] > </div> > [% ELSE %] >+ >+ [% IF ( error_cashup_permission ) %] >+ <div id="error_message" class="dialog alert"> >+ You do not have permission to perform cashup actions. >+ </div> >+ [% END %] >+ >+ [% IF CAN_user_cash_management_cashup %] > <div id="toolbar" class="btn-toolbar"> > <button type="button" class="cashup_all btn btn-default" data-toggle="modal" data-target="#confirmCashupAllModal"><i class="fa fa-money"></i> Cashup all</button> > </div> >+ [% END %] > > <h1>Library transaction details for [% library.branchname | html %]</h1> > >@@ -54,7 +63,9 @@ > <th>Bankable</th> > <th>Income (cash)</th> > <th>Outgoing (cash)</th> >+ [% IF CAN_user_cash_management_cashup %] > <th>Actions</th> >+ [% END %] > </thead> > <tbody> > [% SET bankable = 0, ctotal = 0, dtotal = 0, cctotal = 0, cdtotal = 0 %] >@@ -88,9 +99,12 @@ > [% rdtotal | $Price %] ([% rcdtotal | $Price %]) > [% SET dtotal = dtotal + rdtotal %] > [% SET cdtotal = cdtotal + rcdtotal %] >+ </td> >+ [% IF CAN_user_cash_management_cashup %] > <td> > <button type="button" class="cashup_individual btn btn-default" data-toggle="modal" data-target="#confirmCashupModal" data-register="[% register.description | html %]" data-bankable="[% rbankable | $Price %]" data-float="[% register.starting_float | $Price %]" data-registerid="[% register.id | html %]"><i class="fa fa-money"></i> Record cashup</button> > </td> >+ [% END %] > </tr> > [% END %] > </tbody> >@@ -100,7 +114,11 @@ > <td>[% bankable | $Price %]</td> > <td>[% ctotal | $Price %] ([% cctotal | $Price %])</td> > <td>[% dtotal | $Price %] ([% cdtotal | $Price %])</td> >- <td><button type="button" class="cashup_all btn btn-default" data-toggle="modal" data-target="#confirmCashupAllModal"><i class="fa fa-money"></i> Cashup all</button></td> >+ [% IF CAN_user_cash_management_cashup %] >+ <td> >+ <button type="button" class="cashup_all btn btn-default" data-toggle="modal" data-target="#confirmCashupAllModal"><i class="fa fa-money"></i> Cashup all</button> >+ </td> >+ [% END %] > </tr> > </tfoot> > </table> >diff --git a/pos/registers.pl b/pos/registers.pl >index c2194a2417..44c81363fb 100755 >--- a/pos/registers.pl >+++ b/pos/registers.pl >@@ -56,18 +56,10 @@ else { > > my $op = $input->param('op') // ''; > if ( $op eq 'cashup' ) { >- my $registerid = $input->param('registerid'); >- if ($registerid) { >- my $register = Koha::Cash::Registers->find( { id => $registerid } ); >- $register->add_cashup( >- { >- manager_id => $logged_in_user->id, >- amount => $register->outstanding_accountlines->total >- } >- ); >- } >- else { >- for my $register ( $registers->as_list ) { >+ if ( $logged_in_user->has_permission( { cash_management => 'cashup' } ) ) { >+ my $registerid = $input->param('registerid'); >+ if ($registerid) { >+ my $register = Koha::Cash::Registers->find( { id => $registerid } ); > $register->add_cashup( > { > manager_id => $logged_in_user->id, >@@ -75,6 +67,19 @@ if ( $op eq 'cashup' ) { > } > ); > } >+ else { >+ for my $register ( $registers->as_list ) { >+ $register->add_cashup( >+ { >+ manager_id => $logged_in_user->id, >+ amount => $register->outstanding_accountlines->total >+ } >+ ); >+ } >+ } >+ } >+ else { >+ $template->param( error_cashup_permission => 1 ); > } > } > >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 26023
:
107081
|
107082
|
107767
|
107768
|
108171
|
108172
| 108772 |
108773