Attachment 41380 Details for Bug 13663 – Bug 13663 - Fix permissions in upload-file.pl and upload-file-progress.pl

[patch] Bug 13663 - Fix permissions in upload-file.pl and upload-file-progress.pl

Bug-13663---Fix-permissions-in-upload-filepl-and-u.patch (text/plain), 3.14 KB, created by Jonathan Druart on 2015-08-05 12:29:38 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2015-08-05 12:29:38 UTC

Size: 3.14 KB

patch

obsolete

>From f53776429775325a99c23694eb0d6ca8ed2f794c Mon Sep 17 00:00:00 2001
>From: Alex Arnaud <alex.arnaud@biblibre.com>
>Date: Thu, 11 Jun 2015 10:55:35 +0200
>Subject: [PATCH] Bug 13663 - Fix permissions in upload-file.pl and
> upload-file-progress.pl
>
>Test plan:
>Verify that the circulate_remaining_permissions perm is enough to upload
>.koc file.
>
>Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
>
>Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>---
> tools/upload-file-progress.pl | 21 ++++++++++++++++++---
> tools/upload-file.pl          | 20 +++++++++++++++++---
> 2 files changed, 35 insertions(+), 6 deletions(-)
>
>diff --git a/tools/upload-file-progress.pl b/tools/upload-file-progress.pl
>index 072f44e..3f7d2cd 100755
>--- a/tools/upload-file-progress.pl
>+++ b/tools/upload-file-progress.pl
>@@ -25,14 +25,29 @@ use IO::File;
> use CGI qw ( -utf8 );
> use CGI::Session;
> use C4::Context;
>-use C4::Auth qw/check_cookie_auth/;
>+use C4::Auth qw/check_cookie_auth haspermission/;
> use C4::UploadedFile;
> use CGI::Cookie; # need to check cookies before
>                  # having CGI parse the POST request
> 
>+my $flags_required = [
>+		{circulate => 'circulate_remaining_permissions'},
>+		{tools => 'stage_marc_import'},
>+		{tools => 'upload_local_cover_images'}
>+];
>+
> my %cookies = fetch CGI::Cookie;
>-my ($auth_status, $sessionID) = check_cookie_auth($cookies{'CGISESSID'}->value, { tools => '*' });
>-if ($auth_status ne "ok") {
>+
>+my ($auth_status, $sessionID) = check_cookie_auth($cookies{'CGISESSID'}->value);
>+
>+my $auth_failure = 1;
>+foreach my $flag_required (@{ $flags_required}) {
>+		if (my $flags = haspermission(C4::Context->config('user'), $flag_required)) {
>+				$auth_failure = 0 if $auth_status eq 'ok';
>+		}
>+}
>+
>+if ($auth_failure) {
>     my $reply = CGI->new("");
>     print $reply->header(-type => 'text/html');
>     print '{"progress":"0"}';
>diff --git a/tools/upload-file.pl b/tools/upload-file.pl
>index cc8325a..2dd66f0 100755
>--- a/tools/upload-file.pl
>+++ b/tools/upload-file.pl
>@@ -25,7 +25,7 @@ use IO::File;
> use CGI qw ( -utf8 );
> use CGI::Session;
> use C4::Context;
>-use C4::Auth qw/check_cookie_auth/;
>+use C4::Auth qw/check_cookie_auth haspermission/;
> use CGI::Cookie; # need to check cookies before
>                  # having CGI parse the POST request
> use C4::UploadedFile;
>@@ -38,9 +38,23 @@ use C4::UploadedFile;
> # requires that the session cookie already
> # have been created.
> 
>+my $flags_required = [
>+		{circulate => 'circulate_remaining_permissions'},
>+		{tools => 'stage_marc_import'},
>+		{tools => 'upload_local_cover_images'}
>+];
>+
> my %cookies = fetch CGI::Cookie;
>-my ($auth_status, $sessionID) = check_cookie_auth($cookies{'CGISESSID'}->value, { tools => '*' });
>-if ($auth_status ne "ok") {
>+
>+my $auth_failure = 1;
>+my ($auth_status, $sessionID) = check_cookie_auth($cookies{'CGISESSID'}->value);
>+foreach my $flag_required (@{ $flags_required}) {
>+		if (my $flags = haspermission(C4::Context->config('user'), $flag_required)) {
>+				$auth_failure = 0 if $auth_status eq 'ok';
>+		}
>+}
>+
>+if ($auth_failure) {
>     $auth_status = 'denied' if $auth_status eq 'failed';
>     send_reply($auth_status, "");
>     exit 0;
>-- 
>2.1.0

Actions: View | Diff | Splinter Review

Attachments on bug 13663: 35661 | 35882 | 40089 | 40123 | 40124 | 41380 | 41381