Attachment 87438 Details for Bug 22068 – Bug 22068: Prevent patrons to cancel article request they did not create

[patch] Bug 22068: Prevent patrons to cancel article request they did not create

Bug-22068-Prevent-patrons-to-cancel-article-reques.patch (text/plain), 1.77 KB, created by Ere Maijala on 2019-04-05 07:54:17 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ere Maijala

Created: 2019-04-05 07:54:17 UTC

Size: 1.77 KB

patch

obsolete

>From 52056dd738143699b0446669911b8e58fd28a3a7 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Thu, 14 Feb 2019 17:03:17 -0300
>Subject: [PATCH] Bug 22068: Prevent patrons to cancel article request they did
> not create
>
>opac-article-request-cancel.pl doesn't check that the article request to
>be cancelled actually belongs to the logged-in borrower. This results in
>any logged-in user being able to cancel any article request just by
>changing the id in the URL.
>
>Test plan:
>- Login with Patron P1, create an article request
>- Cancel it
>- Create another one
>- Copy the cancellation link (must be /cgi-bin/koha/opac-article-request-cancel.pl?id=X)
>- Login with Patron P2
>- Hit the cancellation link
>=> Without this patch the article request is cancelled
>=> With this patch applied there is a 404 redirection
>
>Note that the 404 will also appears when the article request id does not
>exist.
>
>Signed-off-by: Ere Maijala <ere.maijala@helsinki.fi>
>---
> opac/opac-article-request-cancel.pl | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
>diff --git a/opac/opac-article-request-cancel.pl b/opac/opac-article-request-cancel.pl
>index baaa0ae7c9..0305808a4b 100755
>--- a/opac/opac-article-request-cancel.pl
>+++ b/opac/opac-article-request-cancel.pl
>@@ -39,9 +39,14 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
> 
> my $id = $query->param('id');
> 
>-if ( $id && $borrowernumber ) {
>+if ( $id ) {
>     my $ar = Koha::ArticleRequests->find( $id );
>-    $ar->cancel() if $ar;
>+    if ( !$ar || $ar->borrowernumber != $borrowernumber ) {
>+        print $query->redirect("/cgi-bin/koha/errors/404.pl");
>+        exit;
>+    }
>+
>+    $ar->cancel();
> }
> 
> print $query->redirect("/cgi-bin/koha/opac-user.pl#opac-user-article-requests");
>-- 
>2.17.1

Actions: View | Diff | Splinter Review

Attachments on bug 22068: 85137 | 87438 | 87460 | 87461