Bugzilla – Attachment 137200 Details for
Bug 31067
Sub-tools permission not applying on intranet-main.tt
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 31067: Fixing missing permission check
Bug-31067-Fixing-missing-permission-check.patch (text/plain), 3.10 KB, created by
Jonathan Druart
on 2022-07-06 09:02:23 UTC
(
hide
)
Description:
Bug 31067: Fixing missing permission check
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2022-07-06 09:02:23 UTC
Size:
3.10 KB
patch
obsolete
>From db960bf45b978e9a2255c6a44628da1d2486295e Mon Sep 17 00:00:00 2001 >From: Florian Bontemps <florian.bontemps@biblibre.com> >Date: Wed, 29 Jun 2022 15:18:17 +0000 >Subject: [PATCH] Bug 31067: Fixing missing permission check > >This patch just fixes a missing permission on the intranet main page. Currently, the Additional Content modules allows people to edit, modify or create new additional content just by checking if they have any tool permission at all, and not the right one. > >To test: >1 - From the staff client, create a news article for the intranet. >2 - Create (or use) an additional staff patron, giving them the necessary permissions to access the intranet, but no tool permission. >3 - Using another browser (or incognito mode), log on the intranet page with your new staff account, you should be able to see the news content, but not edit or delete it. That's the expected behavior. >4 - From your main admin account, give your test account the edit_additional_contents permission. >5 - Your test account should now be able to edit/delete the news content. This is also expected behavior. >6 - Using the main account again, remove this time the edit_additional_contents but add any other subtool permission (edit_calendar is a good one for instance) >7 - Repeat step 5 and confirm that your test account can still edit or delete the news content. This shouldn't happen. >8 - Apply patch >9 - Repeat steps 4-6, and confirm that your test account can now only edit or delete news content if they have the edit_additional_contents permission enabled. > >Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >--- > koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt >index 8f121beab3a..1b556f379b6 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt >@@ -33,7 +33,7 @@ > <div class="newsitem" id="news[% koha_new.idnew | html %]"><h4>[% koha_new.title | html %]</h4> > <div class="newsbody">[% koha_new.content | $raw %]</div> > <p class="newsfooter"> Posted on [% koha_new.published_on | $KohaDates %][% IF( show_author && koha_new.author ) %] by <span class="newsauthor">[% INCLUDE 'patron-title.inc' patron=koha_new.author %]<br />[% END %] >- [% IF ( CAN_user_tools ) %] >+ [% IF ( CAN_user_tools_edit_additional_contents ) %] > <a href="/cgi-bin/koha/tools/additional-contents.pl?op=add_form&id=[% koha_new.idnew | uri %]">Edit</a> > | <a class="news_delete" href="/cgi-bin/koha/tools/additional-contents.pl?op=del&ids=[% koha_new.idnew | html %]">Delete</a> > | <a href="/cgi-bin/koha/tools/additional-contents.pl?op=add_form">New</a> >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 31067
:
136742
|
136745
| 137200