Bugzilla – Attachment 181339 Details for
Bug 39372
No way to restrict OPAC users from creating private lists specifically
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 39372: (follow-up) Add sysprefs to controller scripts
Bug-39372-follow-up-Add-sysprefs-to-controller-scr.patch (text/plain), 2.23 KB, created by
Marion Durand
on 2025-04-23 07:42:22 UTC
(
hide
)
Description:
Bug 39372: (follow-up) Add sysprefs to controller scripts
Filename:
MIME Type:
Creator:
Marion Durand
Created:
2025-04-23 07:42:22 UTC
Size:
2.23 KB
patch
obsolete
>From 6dbd23d67520894bdae1c536d100f2ab5b443bdc Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Wed, 23 Apr 2025 04:37:30 +0000 >Subject: [PATCH] Bug 39372: (follow-up) Add sysprefs to controller scripts > >By adding the sysprefs to the controller scripts, we can prevent >accidental creations or malicious creations. In theory, these error >conditions shouldn't be triggered, since only the allowed actions >will be displayed on the UI, but we need to cover all our bases. > >The error messages in opac-shelves.pl aren't currently translatable. >The error handling will need some refactoring to make them translatable. >However, in this particular case, it should be OK, since no one but a >pen tester should bump into this message. > >Signed-off-by: Marion Durand <marion.durand@biblibre.com> >--- > opac/opac-addbybiblionumber.pl | 2 +- > opac/opac-shelves.pl | 6 ++++++ > 2 files changed, 7 insertions(+), 1 deletion(-) > >diff --git a/opac/opac-addbybiblionumber.pl b/opac/opac-addbybiblionumber.pl >index 23c03ab0de..f886dc61c2 100755 >--- a/opac/opac-addbybiblionumber.pl >+++ b/opac/opac-addbybiblionumber.pl >@@ -61,7 +61,7 @@ if ( $op && $op !~ /^cud-/ ) { > } elsif ($newvirtualshelf) { > if ( > $loggedinuser > 0 >- and ( !$public >+ and ( !$public && C4::Context->preference('OpacAllowPrivateListCreation') > or $public and $loggedinuser > 0 && C4::Context->preference('OpacAllowPublicListCreation') ) > ) > { >diff --git a/opac/opac-shelves.pl b/opac/opac-shelves.pl >index e7dfc65c58..76160e8ba0 100755 >--- a/opac/opac-shelves.pl >+++ b/opac/opac-shelves.pl >@@ -121,6 +121,12 @@ if ( $op eq 'add_form' ) { > if ($loggedinuser) { > my $allow_changes_from = $query->param('allow_changes_from'); > eval { >+ if ( $public && !C4::Context->preference('OpacAllowPublicListCreation') ) { >+ die "Public list creation is not authorized\n"; >+ } elsif ( !$public && !C4::Context->preference('OpacAllowPrivateListCreation') ) { >+ die "Private list creation is not authorized\n"; >+ } >+ > $shelf = Koha::Virtualshelf->new( > { > shelfname => scalar $query->param('shelfname'), >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 39372
:
179497
|
179498
|
179566
|
181333
|
181334
|
181336
|
181337
|
181338
| 181339