Attachment 5234 Details for Bug 6824 – Bug 6824 - correctly check basket viewing permissions

[patch] Bug 6824 - correctly check basket viewing permissions

Bug-6824---correctly-check-basket-viewing-permissi.patch (text/plain), 1.85 KB, created by Robin Sheat on 2011-08-31 03:28:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Robin Sheat

Created: 2011-08-31 03:28:20 UTC

Size: 1.85 KB

patch

obsolete

>From 465813d4bf66fda57aca15c676c7a53c15b5ce4c Mon Sep 17 00:00:00 2001
>From: Robin Sheat <robin@catalyst.net.nz>
>Date: Wed, 31 Aug 2011 15:22:38 +1200
>Subject: [PATCH] Bug 6824 - correctly check basket viewing permissions
>
>Previously you couldn't view baskets that you hadn't created, unless you
>were superlibrarian due to a bug. Now people with the right permissions
>can see the baskets.
>
>Applies to both 3.04.04 and master.
>---
> acqui/basket.pl      |    2 +-
> acqui/booksellers.pl |    2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/acqui/basket.pl b/acqui/basket.pl
>index 303684c..988bd67 100755
>--- a/acqui/basket.pl
>+++ b/acqui/basket.pl
>@@ -197,7 +197,7 @@ if ( $op eq 'delete_confirm' ) {
> #if the basket is closed,and the user has the permission to edit basketgroups, display a list of basketgroups
>     my $basketgroups;
>     my $member = GetMember(borrowernumber => $loggedinuser);
>-    if ($basket->{closedate} && haspermission({ flagsrequired   => { acquisition => 'group_manage'} })) {
>+    if ($basket->{closedate} && haspermission({ acquisition => 'group_manage'} )) {
>         $basketgroups = GetBasketgroups($basket->{booksellerid});
>         for my $bg ( @{$basketgroups} ) {
>             if ($basket->{basketgroupid} && $basket->{basketgroupid} == $bg->{id}){
>diff --git a/acqui/booksellers.pl b/acqui/booksellers.pl
>index cc5c084..fb6b2f1 100755
>--- a/acqui/booksellers.pl
>+++ b/acqui/booksellers.pl
>@@ -106,7 +106,7 @@ for my $vendor (@suppliers) {
>         if ((      $basket->{authorisedby}
>                 && $basket->{authorisedby} eq $loggedinuser
>             )
>-            || haspermission( $uid, { flagsrequired => { acquisition => q{*} } } )
>+            || haspermission( $uid, { acquisition => q{*} } )
>           ) {
>             for my $date_field (qw( creationdate closedate)) {
>                 if ( $basket->{$date_field} ) {
>-- 
>1.7.4.1

Actions: View | Diff | Splinter Review

Attachments on bug 6824: 5234 | 5524