Attachment 64179 Details for Bug 18756 – [SIGNED-OFF] Bug 18756: Users can view aq.baskets even if they are not allowed

[patch] [SIGNED-OFF] Bug 18756: Users can view aq.baskets even if they are not allowed

SIGNED-OFF-Bug-18756-Users-can-view-aqbaskets-even.patch (text/plain), 1.50 KB, created by Josef Moravec on 2017-06-11 08:03:29 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Josef Moravec

Created: 2017-06-11 08:03:29 UTC

Size: 1.50 KB

patch

obsolete

>From 9d1acea38f1e31c3d6974688a7f12ac8fa2e06f9 Mon Sep 17 00:00:00 2001
>From: Christophe Croullebois <christophe.croullebois@biblibre.com>
>Date: Thu, 8 Jun 2017 13:17:56 +0000
>Subject: [PATCH] [SIGNED-OFF] Bug 18756: Users can view aq.baskets even if
> they are not allowed
>
>Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed.
>
>Test plan :
>1- select system preference 'AcqViewBaskets' on 'user'
>2- create 2 borrowers (A, B) with only permissions on acquisition :
>group_manage
>order_manage
>order_receive
>staff
>3- login with A and create a basket
>4- add a basquet manager other than B
>5- relog with account B
>6- you can see the basket
>
>Apply the patch.
>The basket is no longer visible.
>1- relog with A
>2- add basquet manager B
>3- relog with B
>5- you must see the basket
>
>Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
>---
> C4/Acquisition.pm | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/C4/Acquisition.pm b/C4/Acquisition.pm
>index ed80b26..b3b72b9 100644
>--- a/C4/Acquisition.pm
>+++ b/C4/Acquisition.pm
>@@ -859,8 +859,8 @@ sub CanUserManageBasket {
> 
>         if ($AcqViewBaskets eq 'user'
>         && $basket->{authorisedby} != $borrowernumber
>-        && grep($borrowernumber, GetBasketUsers($basketno)) == 0) {
>-            return 0;
>+        && ! grep { $borrowernumber eq $_ } GetBasketUsers($basketno)) {
>+             return 0;
>         }
> 
>         if ($AcqViewBaskets eq 'branch' && defined $basket->{branch}
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 18756: 64103 | 64179 | 64280 | 64403 | 64588 | 64589