Bugzilla – Attachment 31379 Details for
Bug 12873
Reserve can be cancelled by any logged in user
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[PASSED QA] Bug 12873 - Reserve can be cancelled by any logged in user
PASSED-QA-Bug-12873---Reserve-can-be-cancelled-by-.patch (text/plain), 1.60 KB, created by
Martin Renvoize (ashimema)
on 2014-09-04 16:24:57 UTC
(
hide
)
Description:
[PASSED QA] Bug 12873 - Reserve can be cancelled by any logged in user
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2014-09-04 16:24:57 UTC
Size:
1.60 KB
patch
obsolete
>From 4b8ad67b9fb4c1d549c448c8269ed929112a9ef6 Mon Sep 17 00:00:00 2001 >From: Rafal Kopaczka <rkk0@poczta.onet.pl> >Date: Thu, 4 Sep 2014 16:40:33 +0200 >Subject: [PATCH] [PASSED QA] Bug 12873 - Reserve can be cancelled by any > logged in user > >It is possible to cancel reservations through simply running opac-modreserve.pl with existing reserve_id number. This may provide remove even all reservations from system. The only limitation is that user have to be logged in. Simplest solution is to check whether reserve belongs to user or not. > >Test plan: >1. Create reserves by 2 different users, and get their ID's >2. Before patch, hold may by cancelled by anyone who run site: >http://example.com/cgi-bin/koha/opac-modrequest.pl?reserve_id=XXX >3. After patch hold may by cancelled only by user whose reserve is. > >Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > opac/opac-modrequest.pl | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > >diff --git a/opac/opac-modrequest.pl b/opac/opac-modrequest.pl >index cc1e3b3..e55a886 100755 >--- a/opac/opac-modrequest.pl >+++ b/opac/opac-modrequest.pl >@@ -45,7 +45,9 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( > my $reserve_id = $query->param('reserve_id'); > > if ($reserve_id && $borrowernumber) { >- CancelReserve({ reserve_id => $reserve_id }); >+ >+ my $reserve = GetReserve($reserve_id); >+ CancelReserve({ reserve_id => $reserve_id }) if $borrowernumber == $reserve->{borrowernumber} ; > } > > print $query->redirect("/cgi-bin/koha/opac-user.pl#opac-user-holds"); >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 12873
:
31377
|
31378
| 31379