Bugzilla – Attachment 38638 Details for
Bug 13910
Prevent delete of one's own patron account
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 13910 - Prevent delete of one's own patron account
Bug-13910---Prevent-delete-of-ones-own-patron-acco.patch (text/plain), 4.21 KB, created by
Mark Tompsett
on 2015-04-29 07:35:19 UTC
(
hide
)
Description:
Bug 13910 - Prevent delete of one's own patron account
Filename:
MIME Type:
Creator:
Mark Tompsett
Created:
2015-04-29 07:35:19 UTC
Size:
4.21 KB
patch
obsolete
>From b8bc7b4d668df8f6883137d40b9430ae90ef6938 Mon Sep 17 00:00:00 2001 >From: =?UTF-8?q?Marc=20V=C3=A9ron?= <veron@veron.ch> >Date: Thu, 23 Apr 2015 22:50:17 +0200 >Subject: [PATCH] Bug 13910 - Prevent delete of one's own patron account > >This patch adds a check to prevent deleting the user's own account. >Additionali it fixes a "missing link" in moremember.pl and wrong comparisions in moremember.tt regarding other forbidden deleting. > >To test: >- Apply patch >- Create a user with sufficient privileges to delete users >- Log in as this new user >- Try to delete this user. Confirm message box "Are you sure..." >- Confirm that you get a message "Not allowed to delete own account" and that the user still exists. > >Bonus test: >Try to trigger other forbidden deletions (see members/deletemem.pl): 'CANT_DELETE_STAFF', 'CANT_DELETE_OTHERLIBRARY', 'CANT_DELETE' >(You can fake it by using an URL like: /cgi-bin/koha/members/moremember.pl?borrowernumber=115&error=CANT_DELETE_STAFF etc.) >Without patch, no message appears. With patch, messages appear as appropriate. > >Signed-off-by: Mark Tompsett <mtompset@hotmail.com> > >NOTE: Attempted all CANT combinations. From reading the code, >this is kind of an important patch, because I'm not sure >deleting error messages work at all right now based on what >I read. >--- > .../intranet-tmpl/prog/en/modules/members/moremember.tt | 13 +++++++++---- > members/deletemem.pl | 6 ++++++ > members/moremember.pl | 2 ++ > 3 files changed, 17 insertions(+), 4 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt >index d25cdea..cfdfc22 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt >@@ -140,22 +140,27 @@ function validate1(date) { > <div id="yui-main"> > <div class="yui-b"> > [% INCLUDE 'members-toolbar.inc' %] >+ > [% IF ( error ) %] > <div class="dialog alert"> >- [% IF ( AUTH_UPDATE_FAILED ) %] >+ [% IF ( error == 'AUTH_UPDATE_FAILED' ) %] > <h3>Userid / Password update failed</h3> > <strong>Insufficient privileges.</strong> > <p>Other fields updated.</p> > [% END %] >- [% IF ( CANT_DELETE_STAFF ) %] >+ [% IF ( error == 'CANT_DELETE_STAFF' ) %] > <h3>Unable to delete staff user</h3> > <p>Insufficient privileges.</p> > [% END %] >- [% IF ( CANT_DELETE_OTHERLIBRARY ) %] >+ [% IF ( error == 'CANT_DELETE_YOURSELF' ) %] >+ <h3>Not allowed to delete own account</h3> >+ <p>Deleting your own account would lock you out from Koha.</p> >+ [% END %] >+ [% IF ( error == 'CANT_DELETE_OTHERLIBRARY' ) %] > <h3>Unable to delete patrons from other libraries with current settings</h3> > <p>Insufficient privileges.</p> > [% END %] >- [% IF ( CANT_DELETE ) %] >+ [% IF ( error == 'CANT_DELETE' ) %] > <h3>Unable to delete patron</h3> > <p>Insufficient privileges.</p> > [% END %] >diff --git a/members/deletemem.pl b/members/deletemem.pl >index 981e3e3..972a898 100755 >--- a/members/deletemem.pl >+++ b/members/deletemem.pl >@@ -50,6 +50,12 @@ my ($template, $borrowernumber, $cookie) > #print $input->header; > my $member = $input->param('member'); > >+#Do not delete yourself... >+if ($borrowernumber == $member ) { >+ print $input->redirect("/cgi-bin/koha/members/moremember.pl?borrowernumber=$member&error=CANT_DELETE_YOURSELF"); >+ exit 1; >+} >+ > # Handle deletion from the Norwegian national patron database, if it is enabled > # If the "deletelocal" parameter is set to "false", the regular deletion will be > # short circuited, and only a deletion from the national database can be carried >diff --git a/members/moremember.pl b/members/moremember.pl >index a0024cb..57fc4a1 100755 >--- a/members/moremember.pl >+++ b/members/moremember.pl >@@ -112,6 +112,8 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > } > ); > my $borrowernumber = $input->param('borrowernumber'); >+my $error = $input->param('error'); >+$template->param( error => $error ) if ( $error ); > > my ( $od, $issue, $fines ) = GetMemberIssuesAndFines($borrowernumber); > $template->param( issuecount => $issue ); >-- >2.1.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 13910
:
38469
|
38629
|
38638
|
38650
|
38651
|
38652
|
38678
|
38679