Bugzilla – Attachment 81464 Details for
Bug 21702
mancredit.pl incorrectly passes user_id instead of the patron id
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 21702: Make mancredit.pl use the patron id for the staff user
Bug-21702-Make-mancreditpl-use-the-patron-id-for-t.patch (text/plain), 5.34 KB, created by
Andrew Isherwood
on 2018-10-29 09:33:10 UTC
(
hide
)
Description:
Bug 21702: Make mancredit.pl use the patron id for the staff user
Filename:
MIME Type:
Creator:
Andrew Isherwood
Created:
2018-10-29 09:33:10 UTC
Size:
5.34 KB
patch
obsolete
>From 8540c7f1ae18dc2be979a9e98a3059de3930b03e Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Sat, 27 Oct 2018 09:11:33 -0300 >Subject: [PATCH] Bug 21702: Make mancredit.pl use the patron id for the staff > user > >I think unsafe SQL modes and the fact that manager_id has no FK allowed this to go unnoticed. But now we catch it! > >To test: >- On a patron, try adding a new manual credit of any type >=> FAIL: It fails telling the userid of the logged user is not a valid integer! >- Apply this patch >- Try adding a manual credit of any type >=> SUCCESS: Manual credit added! >- Sign off! > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> > >Signed-off-by: Andrew Isherwood <andrew.isherwood@ptfs-europe.com> >--- > members/mancredit.pl | 90 ++++++++++++++++++++++++---------------------------- > 1 file changed, 42 insertions(+), 48 deletions(-) > >diff --git a/members/mancredit.pl b/members/mancredit.pl >index 813461eaeb..49ab8a4213 100755 >--- a/members/mancredit.pl >+++ b/members/mancredit.pl >@@ -33,73 +33,67 @@ use C4::Accounts; > use C4::Items; > use C4::Members::Attributes qw(GetBorrowerAttributes); > >-use Koha::Account; > use Koha::Items; > use Koha::Patrons; > use Koha::Patron::Categories; > use Koha::Token; > > my $input=new CGI; >-my $flagsrequired = { borrowers => 'edit_borrowers', updatecharges => 1 }; > >-my $borrowernumber=$input->param('borrowernumber'); >+my ($template, $loggedinuser, $cookie) = get_template_and_user( >+ { >+ template_name => "members/mancredit.tt", >+ query => $input, >+ type => "intranet", >+ authnotrequired => 0, >+ flagsrequired => { borrowers => 'edit_borrowers', >+ updatecharges => 'remaining_permissions' } >+ } >+); >+ >+my $logged_in_user = Koha::Patrons->find($loggedinuser) or die "Not logged in"; >+my $borrowernumber = $input->param('borrowernumber'); >+my $patron = Koha::Patrons->find($borrowernumber); > >-my $patron = Koha::Patrons->find( $borrowernumber ); > unless ( $patron ) { > print $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber"); > exit; > } >-my $add=$input->param('add'); >+my $add = $input->param('add'); > > if ($add){ > >- my ( $user_id ) = checkauth( $input, 0, $flagsrequired, 'intranet' ); >- >- if ( $user_id ) { >- >- die "Wrong CSRF token" >- unless Koha::Token->new->check_csrf( { >- session_id => scalar $input->cookie('CGISESSID'), >- token => scalar $input->param('csrf_token'), >- }); >- >- # Note: If the logged in user is not allowed to see this patron an invoice can be forced >- # Here we are trusting librarians not to hack the system >- my $barcode = $input->param('barcode'); >- my $item_id; >- if ($barcode) { >- my $item = Koha::Items->find({barcode => $barcode}); >- $item_id = $item->itemnumber if $item; >- } >- my $description = $input->param('desc'); >- my $note = $input->param('note'); >- my $amount = $input->param('amount') || 0; >- my $type = $input->param('type'); >- >- Koha::Account->new({ patron_id => $borrowernumber })->add_credit({ >- amount => $amount, >- description => $description, >- item_id => $item_id, >- note => $note, >- type => $type, >- user_id => $user_id >+ die "Wrong CSRF token" >+ unless Koha::Token->new->check_csrf( { >+ session_id => scalar $input->cookie('CGISESSID'), >+ token => scalar $input->param('csrf_token'), > }); > >- print $input->redirect("/cgi-bin/koha/members/boraccount.pl?borrowernumber=$borrowernumber"); >+ # Note: If the logged in user is not allowed to see this patron an invoice can be forced >+ # Here we are trusting librarians not to hack the system >+ my $barcode = $input->param('barcode'); >+ my $item_id; >+ if ($barcode) { >+ my $item = Koha::Items->find({barcode => $barcode}); >+ $item_id = $item->itemnumber if $item; > } >+ my $description = $input->param('desc'); >+ my $note = $input->param('note'); >+ my $amount = $input->param('amount') || 0; >+ my $type = $input->param('type'); >+ >+ $patron->account->add_credit({ >+ amount => $amount, >+ description => $description, >+ item_id => $item_id, >+ note => $note, >+ type => $type, >+ user_id => $logged_in_user->id >+ }); >+ >+ print $input->redirect("/cgi-bin/koha/members/boraccount.pl?borrowernumber=$borrowernumber"); >+ > } else { >- my ($template, $loggedinuser, $cookie) = get_template_and_user( >- { >- template_name => "members/mancredit.tt", >- query => $input, >- type => "intranet", >- authnotrequired => 0, >- flagsrequired => { borrowers => 'edit_borrowers', >- updatecharges => 'remaining_permissions' }, >- debug => 1, >- } >- ); >- my $logged_in_user = Koha::Patrons->find( $loggedinuser ) or die "Not logged in"; > output_and_exit_if_error( $input, $cookie, $template, { module => 'members', logged_in_user => $logged_in_user, current_patron => $patron } ); > > if (C4::Context->preference('ExtendedPatronAttributes')) { >-- >2.11.0
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=81464">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 21702
:
81360
|
81361
|
81464
|
81465
|
81593
|
81594