Attachment 40595 Details for Bug 14440 – Bug 14440 - get_template_and_user can not have an empty template_name (updatesupplier.pl)

[patch] Bug 14440 - get_template_and_user can not have an empty template_name (updatesupplier.pl)

Bug-14440---gettemplateanduser-can-not-have-an-emp.patch (text/plain), 1.77 KB, created by Indranil Das Gupta on 2015-06-24 17:31:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Indranil Das Gupta

Created: 2015-06-24 17:31:37 UTC

Size: 1.77 KB

patch

obsolete

>From 1e2720d4def295e3ed103d702932ce3ef48c06c5 Mon Sep 17 00:00:00 2001
>From: Fridolin Somers <fridolin.somers@biblibre.com>
>Date: Tue, 23 Jun 2015 16:45:21 +0200
>Subject: [PATCH] Bug 14440 - get_template_and_user can not have an empty
> template_name (updatesupplier.pl)
>
>Since Bug 14408, the method get_template_and_user can not have an empty template_name.
>Pages calling with an empty value should use C4::Auth::checkauth()
>
>This patch corrects acqui/updatesupplier.pl
>
>Test plan :
>- Apply patch
>- Connect to intranet with a user having "vendors_manage" permission
>- Go to acquisition module
>- Create a new vendor
>- Click on "Edit vendor"
>- Change some information and save
>=> Your change is saved
>- Connect to intranet with a user not having "vendors_manage" permission
>- Try to access <intranet>/cgi-bin/koha/acqui/updatesupplier.pl
>=> Access is denied
>- Disconnect from intranet
>- Try to access <intranet>/cgi-bin/koha/acqui/updatesupplier.pl
>=> Access is denied
>
>Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
>---
> acqui/updatesupplier.pl | 11 ++---------
> 1 file changed, 2 insertions(+), 9 deletions(-)
>
>diff --git a/acqui/updatesupplier.pl b/acqui/updatesupplier.pl
>index 65093d8..c064f76 100755
>--- a/acqui/updatesupplier.pl
>+++ b/acqui/updatesupplier.pl
>@@ -59,15 +59,8 @@ use C4::Output;
> use CGI qw ( -utf8 );
> 
> my $input=new CGI;
>-my ($template, $loggedinuser, $cookie) = get_template_and_user(
>-	{   template_name   => "",
>-		query           => $input,
>-		type            => "intranet",
>-		authnotrequired => 0,
>-		flagsrequired   => { acquisition => 'vendors_manage' },
>-		debug           => 1,
>-	}
>-);
>+
>+checkauth( $input, 0, { acquisition => 'vendors_manage' }, 'intranet' );
> 
> #print $input->header();
> my $booksellerid=$input->param('booksellerid');
>-- 
>1.9.1

Actions: View | Diff | Splinter Review

Attachments on bug 14440: 40533 | 40544 | 40546 | 40559 | 40595 | 40600 | 40601 | 40602 | 40607 | 40608 | 40609 | 40620 | 40621 | 40622 | 40648