Attachment 41667 Details for Bug 14321 – Bug 14321: Fix permissions check in upload-file.pl

[patch] Bug 14321: Fix permissions check in upload-file.pl

Bug-14321-Fix-permissions-check-in-upload-filepl.patch (text/plain), 1.93 KB, created by Marcel de Rooy on 2015-08-19 13:51:04 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2015-08-19 13:51:04 UTC

Size: 1.93 KB

patch

obsolete

>From d37e7f7c6d79aa0a7120cd7d6603108a21379367 Mon Sep 17 00:00:00 2001
>From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>Date: Mon, 17 Aug 2015 12:26:44 +0200
>Subject: [PATCH] Bug 14321: Fix permissions check in upload-file.pl
>Content-Type: text/plain; charset=utf-8
>
>This fixes an error in one of the patches of bug 6874.
>The userid of the Koha admin user is passed to haspermission, but we
>should pick the userid from the session.
>
>NOTE: Bug 14686 will add a specific permission for tools/upload.pl. At
>that time we can add the script to the Tools menu too. For now, you
>need edit_catalogue to start upload.pl and you will additionally need
>a permission like upload_local_cover_images (see tools/upload-file) to
>successfully upload a new file. Searching for files and copying URLs
>to the editor can still be done with edit_catalogue.
>
>Test plan:
>[1] Pick a staff user that only has catalogue and edit_catalogue.
>[2] Without this patch, you can upload a file on tools/upload.pl.
>[3] Apply this patch.
>[4] Retry. Should not work: Upload status is Denied.
>[5] Login with enough permissions. Upload again.
>---
> tools/upload-file.pl |    6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/tools/upload-file.pl b/tools/upload-file.pl
>index ffa9d30..e935751 100755
>--- a/tools/upload-file.pl
>+++ b/tools/upload-file.pl
>@@ -48,15 +48,15 @@ my $sid = $cookies{'CGISESSID'}->value;
> 
> my $auth_failure = 1;
> my ( $auth_status, $sessionID ) = check_cookie_auth( $sid );
>+my $uid = C4::Auth::get_session($sid)->param('id');
> foreach my $flag_required ( @{$flags_required} ) {
>-    if ( my $flags = haspermission( C4::Context->config('user'), $flag_required ) ) {
>+    if ( my $flags = haspermission( $uid, $flag_required ) ) {
>         $auth_failure = 0 if $auth_status eq 'ok';
>     }
> }
> 
> if ($auth_failure) {
>-    $auth_status = 'denied' if $auth_status eq 'failed';
>-    send_reply( $auth_status );
>+    send_reply( 'denied' );
>     exit 0;
> }
> 
>-- 
>1.7.10.4

Actions: View | Diff | Splinter Review

Attachments on bug 14321: 41498 | 41499 | 41500 | 41501 | 41555 | 41556 | 41557 | 41558 | 41559 | 41560 | 41561 | 41562 | 41665 | 41666 | 41667 | 41668 | 41669 | 41677 | 41873 | 41874 | 41875 | 41876 | 41877 | 41878 | 41879 | 41880 | 41881 | 42411 | 42412 | 42413 | 42414 | 42558 | 42559 | 42560 | 42561 | 42584 | 42587 | 42588 | 42589 | 42590 | 42591 | 42660 | 42661 | 42662 | 42663 | 42664 | 42665 | 42666 | 42707 | 42726 | 42727 | 42728 | 42729 | 42730 | 42731 | 42732 | 42889 | 42890