Bugzilla – Attachment 168286 Details for
Bug 13342
Not logged in user can place a review/comment as a deleted patron
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 13342 - Not logged in user can place a review/comment as a deleted patron
Bug-13342---Not-logged-in-user-can-place-a-reviewc.patch (text/plain), 4.86 KB, created by
Alexandre Noel
on 2024-06-28 18:23:49 UTC
(
hide
)
Description:
Bug 13342 - Not logged in user can place a review/comment as a deleted patron
Filename:
MIME Type:
Creator:
Alexandre Noel
Created:
2024-06-28 18:23:49 UTC
Size:
4.86 KB
patch
obsolete
>From 128a57f7b23ca36c032a2f88e20ee4ef9571bc16 Mon Sep 17 00:00:00 2001 >From: Alexandre Noel <alexandre.noel@inlibro.com> >Date: Fri, 28 Jun 2024 11:43:55 -0400 >Subject: [PATCH] Bug 13342 - Not logged in user can place a review/comment as > a deleted patron > >I find out the post comments page allows not logged in user, so I simply deleted the >relevant line. > >1. Apply the patch >2. Log in to OPAC. >3. Find a Biblio and open the comments tab. >4. Open another tab/window, and log out from that page. >5. Return to the first page. >6. Click "Post your comments on this title." > --> You should be redirected to the login page in a new window. > >7. In the new window, log in again. >8. Write a comment but don't submit it. >9. In the seconf tab, log out from the account. >10. Return to the form post comments and click "Submit and close this > window" > --> You should be redirected to the login page. >--- > opac/opac-review.pl | 62 ++++++++++++++++++++++----------------------- > 1 file changed, 31 insertions(+), 31 deletions(-) > >diff --git a/opac/opac-review.pl b/opac/opac-review.pl >index e948e1cf16..6105387896 100755 >--- a/opac/opac-review.pl >+++ b/opac/opac-review.pl >@@ -36,62 +36,62 @@ my $op = $query->param('op') // q{}; > > my ( $template, $borrowernumber, $cookie ) = get_template_and_user( > { >- template_name => "opac-review.tt", >- query => $query, >- type => "opac", >- authnotrequired => ( C4::Context->preference("OpacPublic") ? 1 : 0 ), >+ template_name => "opac-review.tt", >+ query => $query, >+ type => "opac", > } > ); > > # FIXME: need to allow user to delete their own comment(s) > > my ( $clean, @errors, $savedreview ); >-my $biblio = Koha::Biblios->find( $biblionumber ); >+my $biblio = Koha::Biblios->find($biblionumber); > >-if( !$biblio ) { >+if ( !$biblio ) { > push @errors, { nobiblio => 1 }; >-} elsif( $reviewid ) { # edit existing one, check on creator >- $savedreview = Koha::Reviews->search({ reviewid => $reviewid, borrowernumber => $borrowernumber })->next; >+} elsif ($reviewid) { # edit existing one, check on creator >+ $savedreview = Koha::Reviews->search( { reviewid => $reviewid, borrowernumber => $borrowernumber } )->next; > push @errors, { unauthorized => 1 } if !$savedreview; >-} else { # this check prevents adding multiple comments >- # FIXME biblionumber, borrowernumber should be a unique key of reviews >- $savedreview = Koha::Reviews->search({ biblionumber => $biblionumber, borrowernumber => $borrowernumber })->next; >- $review = $savedreview? $savedreview->review: $review; >+} else { # this check prevents adding multiple comments >+ # FIXME biblionumber, borrowernumber should be a unique key of reviews >+ $savedreview = Koha::Reviews->search( { biblionumber => $biblionumber, borrowernumber => $borrowernumber } )->next; >+ $review = $savedreview ? $savedreview->review : $review; > } > >-if( $op =~ /^cud-/ && !@errors && defined $review ) { >- if ($review !~ /\S/) { >- push @errors, {empty=>1}; >- } else { >- $clean = C4::Scrubber->new('comment')->scrub($review); >- if ($clean !~ /\S/) { >- push @errors, {scrubbed_all=>1}; >- } else { >- if ($clean ne $review) { >- push @errors, {scrubbed=>$clean}; >- } >+if ( $op =~ /^cud-/ && !@errors && defined $review ) { >+ if ( $review !~ /\S/ ) { >+ push @errors, { empty => 1 }; >+ } else { >+ $clean = C4::Scrubber->new('comment')->scrub($review); >+ if ( $clean !~ /\S/ ) { >+ push @errors, { scrubbed_all => 1 }; >+ } else { >+ if ( $clean ne $review ) { >+ push @errors, { scrubbed => $clean }; >+ } > if ($savedreview) { > $savedreview->set( > { >- review => $clean, >- approved => 0, >- datereviewed => dt_from_string >+ review => $clean, >+ approved => 0, >+ datereviewed => dt_from_string > } > )->store; > } else { > $reviewid = Koha::Review->new( >- { biblionumber => $biblionumber, >+ { >+ biblionumber => $biblionumber, > borrowernumber => $borrowernumber, > review => $clean, > datereviewed => dt_from_string > } > )->store->reviewid; > } >- unless (@errors){ $template->param(WINDOW_CLOSE=>1); } >- } >- } >+ unless (@errors) { $template->param( WINDOW_CLOSE => 1 ); } >+ } >+ } > } >-(@errors ) and $template->param( ERRORS=>\@errors); >+(@errors) and $template->param( ERRORS => \@errors ); > $review = $clean; > $review ||= $savedreview->review if $savedreview; > $template->param( >-- >2.34.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 13342
:
168286
|
171000
|
171001
|
171109
|
171110
|
171111
|
171118