Bugzilla – Attachment 31837 Details for
Bug 643
Allow override of 'debarred' status
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 643: QA Followup - server-side verification of permissions
Bug-643-QA-Followup---server-side-verification-of-.patch (text/plain), 1.54 KB, created by
Mark Tompsett
on 2014-09-23 14:18:48 UTC
(
hide
)
Description:
Bug 643: QA Followup - server-side verification of permissions
Filename:
MIME Type:
Creator:
Mark Tompsett
Created:
2014-09-23 14:18:48 UTC
Size:
1.54 KB
patch
obsolete
>From 4ac2e15998aa146b08e4eb4e37c42535dcf3d9fd Mon Sep 17 00:00:00 2001 >From: Mark Tompsett <mtompset@hotmail.com> >Date: Tue, 23 Sep 2014 10:12:12 -0400 >Subject: [PATCH] Bug 643: QA Followup - server-side verification of > permissions > >Only allow $force_allow=1 if the logged in user has permissions. > >TEST PLAN >--------- >Attempt to intentionally override the checkout by passing an >appropriately handcrafted URL. >-- Regardless of the force_allow value, it should be not allowed > for those lacking the force_checkout permission. > >NOTE: I didn't test this. I figured Marc Veron could do that. :) > (Sorry, couldn't easily get git bz to work with the accent) >--- > circ/circulation.pl | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > >diff --git a/circ/circulation.pl b/circ/circulation.pl >index 131c8b0..c920787 100755 >--- a/circ/circulation.pl >+++ b/circ/circulation.pl >@@ -27,7 +27,7 @@ use warnings; > use CGI; > use C4::Output; > use C4::Print; >-use C4::Auth qw/:DEFAULT get_session/; >+use C4::Auth qw/:DEFAULT get_session haspermission/; > use C4::Dates qw/format_date/; > use C4::Branch; # GetBranches > use C4::Koha; # GetPrinter >@@ -98,6 +98,9 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user ( > my $branches = GetBranches(); > > my $force_allow_issue = $query->param('forceallow') || 0; >+if (!C4::Auth::haspermission( C4::Context->userenv->{id} , { circulate => 'force_checkout' } )) { >+ $force_allow_issue = 0; >+} > > my @failedrenews = $query->param('failedrenew'); # expected to be itemnumbers > our %renew_failed = (); >-- >1.7.9.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 643
:
9010
|
28453
|
28753
|
30715
|
30716
|
30726
|
30727
|
31564
|
31837
|
31997
|
31998
|
31999
|
32120
|
32121
|
32122
|
32925
|
32946