Attachment 40609 Details for Bug 14440 – [SIGNED OFF] Bug 14440: get_template_and_user can not have an empty template_name (quote*_ajax.pl)

[patch] [SIGNED OFF] Bug 14440: get_template_and_user can not have an empty template_name (quote*_ajax.pl)

SIGNED-OFFBug-14440-gettemplateanduser-can-not-hav.patch (text/plain), 2.88 KB, created by Tomás Cohen Arazi (tcohen) on 2015-06-24 21:28:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomás Cohen Arazi (tcohen)

Created: 2015-06-24 21:28:14 UTC

Size: 2.88 KB

patch

obsolete

>From 02efb7c82fe34cffaa186340f8162e8776b7601c Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@koha-community.org>
>Date: Wed, 24 Jun 2015 11:03:22 +0200
>Subject: [PATCH] =?UTF-8?q?[SIGNED=20OFF]=C2=A0Bug=2014440:=20get=5Ftempla?=
> =?UTF-8?q?te=5Fand=5Fuser=20can=20not=20have=20an=20empty=20template=5Fna?=
> =?UTF-8?q?me=20(quote*=5Fajax.pl)?=
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>This patch uses check_api_auth instead of get_template_and_user.
>
>Test plan:
>Confirm that you are still able to access to the quote editor with the
>edit_quotes permission.
>Confirm that you are not if you don't have the permission.
>
>wget your_url/cgi-bin/koha/tools/quotes/quotes_ajax.pl
>should return "403Â : Forbidden."
>
>Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
>Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
>---
> tools/quotes/quotes-upload_ajax.pl | 16 ++++++----------
> tools/quotes/quotes_ajax.pl        | 16 ++++++----------
> 2 files changed, 12 insertions(+), 20 deletions(-)
>
>diff --git a/tools/quotes/quotes-upload_ajax.pl b/tools/quotes/quotes-upload_ajax.pl
>index 93bbfbe..179c645 100755
>--- a/tools/quotes/quotes-upload_ajax.pl
>+++ b/tools/quotes/quotes-upload_ajax.pl
>@@ -32,16 +32,12 @@ use C4::Output;
> my $cgi = new CGI;
> my $dbh = C4::Context->dbh;
> 
>-my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
>-    {
>-        template_name   => "",
>-        query           => $cgi,
>-        type            => "intranet",
>-        authnotrequired => 0,
>-        flagsrequired   => { tools => 'edit_quotes' },
>-        debug           => 1,
>-    }
>-);
>+my ( $status, $cookie, $sessionID ) = C4::Auth::check_api_auth( $cgi, { tools => 'edit_quotes' } );
>+unless ($status eq "ok") {
>+    print $cgi->header(-type => 'application/json', -status => '403 Forbidden');
>+    print to_json({ auth_status => $status });
>+    exit 0;
>+}
> 
> my $success = 'true';
> 
>diff --git a/tools/quotes/quotes_ajax.pl b/tools/quotes/quotes_ajax.pl
>index d08178f..c4bbae3 100755
>--- a/tools/quotes/quotes_ajax.pl
>+++ b/tools/quotes/quotes_ajax.pl
>@@ -31,16 +31,12 @@ my $cgi = CGI->new;
> my $dbh = C4::Context->dbh;
> my $sort_columns = ["id", "source", "text", "timestamp"];
> 
>-my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
>-    {
>-        template_name   => "",
>-        query           => $cgi,
>-        type            => "intranet",
>-        authnotrequired => 0,
>-        flagsrequired   => { tools => 'edit_quotes' },
>-        debug           => 1,
>-    }
>-);
>+my ( $status, $cookie, $sessionID ) = C4::Auth::check_api_auth( $cgi, { tools => 'edit_quotes' } );
>+unless ($status eq "ok") {
>+    print $cgi->header(-type => 'application/json', -status => '403 Forbidden');
>+    print to_json({ auth_status => $status });
>+    exit 0;
>+}
> 
> # NOTE: This is a collection of ajax functions for use with tools/quotes.pl
> 
>-- 
>2.4.4

Actions: View | Diff | Splinter Review

Attachments on bug 14440: 40533 | 40544 | 40546 | 40559 | 40595 | 40600 | 40601 | 40602 | 40607 | 40608 | 40609 | 40620 | 40621 | 40622 | 40648