Bugzilla – Attachment 31999 Details for
Bug 643
Allow override of 'debarred' status
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
[SIGNED OFF] Bug 643: QA Followup - server-side verification of permissions
SIGNED-OFF-Bug-643-QA-Followup---server-side-verif.patch (text/plain), 1.61 KB, created by
Nick Clemens (kidclamp)
on 2014-10-05 01:47:31 UTC
(
hide
)
Description:
[SIGNED OFF] Bug 643: QA Followup - server-side verification of permissions
Filename:
MIME Type:
Creator:
Nick Clemens (kidclamp)
Created:
2014-10-05 01:47:31 UTC
Size:
1.61 KB
patch
obsolete
>From 2bd5fd9e1bc87eb5a9cc9c82f18632280bdcc9a7 Mon Sep 17 00:00:00 2001 >From: Mark Tompsett <mtompset@hotmail.com> >Date: Tue, 23 Sep 2014 10:12:12 -0400 >Subject: [PATCH] [SIGNED OFF] Bug 643: QA Followup - server-side verification > of permissions > >Only allow $force_allow=1 if the logged in user has permissions. > >TEST PLAN >--------- >Attempt to intentionally override the checkout by passing an >appropriately handcrafted URL. >-- Regardless of the force_allow value, it should be not allowed > for those lacking the force_checkout permission. > >NOTE: I didn't test this. I figured Marc Veron could do that. :) > (Sorry, couldn't easily get git bz to work with the accent) > >Signed-off-by: Nick Clemens <nick@quecheelibrary.org> >--- > circ/circulation.pl | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > >diff --git a/circ/circulation.pl b/circ/circulation.pl >index 131c8b0..c920787 100755 >--- a/circ/circulation.pl >+++ b/circ/circulation.pl >@@ -27,7 +27,7 @@ use warnings; > use CGI; > use C4::Output; > use C4::Print; >-use C4::Auth qw/:DEFAULT get_session/; >+use C4::Auth qw/:DEFAULT get_session haspermission/; > use C4::Dates qw/format_date/; > use C4::Branch; # GetBranches > use C4::Koha; # GetPrinter >@@ -98,6 +98,9 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user ( > my $branches = GetBranches(); > > my $force_allow_issue = $query->param('forceallow') || 0; >+if (!C4::Auth::haspermission( C4::Context->userenv->{id} , { circulate => 'force_checkout' } )) { >+ $force_allow_issue = 0; >+} > > my @failedrenews = $query->param('failedrenew'); # expected to be itemnumbers > our %renew_failed = (); >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 643
:
9010
|
28453
|
28753
|
30715
|
30716
|
30726
|
30727
|
31564
|
31837
|
31997
|
31998
|
31999
|
32120
|
32121
|
32122
|
32925
|
32946