Bugzilla – Attachment 150924 Details for
Bug 33702
Patrons should only see their own ILLs in the OPAC
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 33702: Prevent ILL requests to be modified by somebody else
Bug-33702-Prevent-ILL-requests-to-be-modified-by-s.patch (text/plain), 3.17 KB, created by
Jonathan Druart
on 2023-05-10 05:40:58 UTC
(
hide
)
Description:
Bug 33702: Prevent ILL requests to be modified by somebody else
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2023-05-10 05:40:58 UTC
Size:
3.17 KB
patch
obsolete
>From 33e477227005b1562d14dbba7616c3f6a0104466 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 10 May 2023 07:37:57 +0200 >Subject: [PATCH] Bug 33702: Prevent ILL requests to be modified by somebody > else > >Same as previous patch, but for 'update' and 'cancreq'. >We remove the redirect, but here we only want to focus on the security >fix. > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >--- > opac/opac-illrequests.pl | 44 ++++++++++++++++------------------------ > 1 file changed, 17 insertions(+), 27 deletions(-) > >diff --git a/opac/opac-illrequests.pl b/opac/opac-illrequests.pl >index 0219174cb74..c97f32b47aa 100755 >--- a/opac/opac-illrequests.pl >+++ b/opac/opac-illrequests.pl >@@ -59,56 +59,46 @@ $template->param( backends_available => $backends_available ); > > my $op = $params->{'method'} || 'list'; > >+my ( $illrequest_id, $request ); >+if ( $illrequest_id = $params->{illrequest_id} ) { >+ $request = Koha::Illrequests->find($illrequest_id); >+ # Make sure the request belongs to the logged in user >+ unless ( $request->borrowernumber == $loggedinuser ) { >+ print $query->redirect("/cgi-bin/koha/errors/404.pl"); >+ exit; >+ } >+} >+ > if ( $op eq 'list' ) { > > my $requests = Koha::Illrequests->search( > { borrowernumber => $loggedinuser } > ); >- my $req = Koha::Illrequest->new; > $template->param( > requests => $requests, >- backends => $backends >+ backends => $backends > ); > > } elsif ( $op eq 'view') { >- my $request = Koha::Illrequests->find({ >- borrowernumber => $loggedinuser, >- illrequest_id => $params->{illrequest_id} >- }); >- # Make sure the request belongs to the logged in user >- unless ( $request->borrowernumber == $loggedinuser ) { >- print $query->redirect("/cgi-bin/koha/errors/404.pl"); >- exit; >- } > $template->param( > request => $request > ); > > } elsif ( $op eq 'update') { >- my $request = Koha::Illrequests->find({ >- borrowernumber => $loggedinuser, >- illrequest_id => $params->{illrequest_id} >- }); > $request->notesopac($params->{notesopac})->store; > # Send a notice to staff alerting them of the update > $request->send_staff_notice('ILL_REQUEST_MODIFIED'); > print $query->redirect( >- '/cgi-bin/koha/opac-illrequests.pl?method=view&illrequest_id=' . >- $params->{illrequest_id} . >- '&message=1' >- ); >+ '/cgi-bin/koha/opac-illrequests.pl?method=view&illrequest_id=' >+ . $illrequest_id >+ . '&message=1' ); > exit; > } elsif ( $op eq 'cancreq') { >- my $request = Koha::Illrequests->find({ >- borrowernumber => $loggedinuser, >- illrequest_id => $params->{illrequest_id} >- }); > $request->status('CANCREQ')->store; > print $query->redirect( >- '/cgi-bin/koha/opac-illrequests.pl?method=view&illrequest_id=' . >- $params->{illrequest_id} . >- '&message=1' >- ); >+ '/cgi-bin/koha/opac-illrequests.pl?method=view&illrequest_id=' >+ . $illrequest_id >+ . '&message=1' ); > exit; > } elsif ( $op eq 'create' ) { > if (!$params->{backend}) { >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 33702
:
150892
|
150923
|
150924
|
150939
|
151111
|
151112
|
151113