Attachment 64588 Details for Bug 18756 – Bug 18756: Users can view aq.baskets even if they are not allowed

[patch] Bug 18756: Users can view aq.baskets even if they are not allowed

Bug-18756-Users-can-view-aqbaskets-even-if-they-ar.patch (text/plain), 1.54 KB, created by Nick Clemens (kidclamp) on 2017-06-23 11:03:59 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nick Clemens (kidclamp)

Created: 2017-06-23 11:03:59 UTC

Size: 1.54 KB

patch

obsolete

>From 7132fec0d38f8f3cf934c3c81096e3c8e891b501 Mon Sep 17 00:00:00 2001
>From: Christophe Croullebois <christophe.croullebois@biblibre.com>
>Date: Thu, 8 Jun 2017 13:17:56 +0000
>Subject: [PATCH] Bug 18756: Users can view aq.baskets even if they are not
> allowed
>
>Due to bad use of grep syntax if there is one or more Basket Users the result of grep is not equal to 0 and the borrower is allowed.
>
>Test plan :
>1- select system preference 'AcqViewBaskets' on 'user'
>2- create 2 borrowers (A, B) with only permissions on acquisition :
>group_manage
>order_manage
>order_receive
>staff
>3- login with A and create a basket
>4- add a basquet manager other than B
>5- relog with account B
>6- you can see the basket
>
>Apply the patch.
>The basket is no longer visible.
>1- relog with A
>2- add basquet manager B
>3- relog with B
>5- you must see the basket
>
>Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
>
>Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
>---
> C4/Acquisition.pm | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/C4/Acquisition.pm b/C4/Acquisition.pm
>index ed80b26..b3b72b9 100644
>--- a/C4/Acquisition.pm
>+++ b/C4/Acquisition.pm
>@@ -859,8 +859,8 @@ sub CanUserManageBasket {
> 
>         if ($AcqViewBaskets eq 'user'
>         && $basket->{authorisedby} != $borrowernumber
>-        && grep($borrowernumber, GetBasketUsers($basketno)) == 0) {
>-            return 0;
>+        && ! grep { $borrowernumber eq $_ } GetBasketUsers($basketno)) {
>+             return 0;
>         }
> 
>         if ($AcqViewBaskets eq 'branch' && defined $basket->{branch}
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 18756: 64103 | 64179 | 64280 | 64403 | 64588 | 64589