Attachment 11905 Details for Bug 8706 – Bug 8706 - Private lists can be accessed by anyone

[patch] Bug 8706 - Private lists can be accessed by anyone

Bug-8706---Private-lists-can-be-accessed-by-anyone.patch (text/plain), 1.15 KB, created by Kyle M Hall (khall) on 2012-08-31 11:38:13 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kyle M Hall (khall)

Created: 2012-08-31 11:38:13 UTC

Size: 1.15 KB

patch

obsolete

>From 051b3a1298d5e03d7f21b48314658d91308fecae Mon Sep 17 00:00:00 2001
>From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>Date: Fri, 31 Aug 2012 11:48:51 +0200
>Subject: [PATCH] Bug 8706 - Private lists can be accessed by anyone
>Content-Type: text/plain; charset="utf-8"
>
>Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
>
>Confirmed private lists can be accessed directly before patch is
>applied. After applying patch, I can no longer access the list
>via the same url.
>---
> C4/VirtualShelves.pm |    2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
>diff --git a/C4/VirtualShelves.pm b/C4/VirtualShelves.pm
>index 20f3620..c235985 100644
>--- a/C4/VirtualShelves.pm
>+++ b/C4/VirtualShelves.pm
>@@ -464,7 +464,7 @@ sub ShelfPossibleAction {
>     $sth->execute($user, $shelfnumber);
>     my $shelf= $sth->fetchrow_hashref;
> 
>-    return 0 unless $shelf && ($shelf->{category}==2 || $shelf->{owner}==$user || $shelf->{borrowernumber}==$user);
>+    return 0 unless $shelf && ($shelf->{category}==2 || $shelf->{owner}==$user || ($user && $shelf->{borrowernumber}==$user));
>     if($action eq 'view') {
>         #already handled in the above condition
>         return 1;
>-- 
>1.7.2.5

Actions: View | Diff | Splinter Review

Attachments on bug 8706: 11904 | 11905