Bugzilla – Attachment 100764 Details for
Bug 24878
Authentication check missing on calendar tools
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 24878: Add authentication checks to the calendar tool
Bug-24878-Add-authentication-checks-to-the-calenda.patch (text/plain), 1.37 KB, created by
Jonathan Druart
on 2020-03-16 15:28:22 UTC
(
hide
)
Description:
Bug 24878: Add authentication checks to the calendar tool
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2020-03-16 15:28:22 UTC
Size:
1.37 KB
patch
obsolete
>From b26cdc0a18399b92d245b56aae921f96b263f408 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Mon, 16 Mar 2020 16:26:48 +0100 >Subject: [PATCH] Bug 24878: Add authentication checks to the calendar tool > >There is a security hole in 2 scripts that are used by the UI to edit >holidays. >--- > tools/exceptionHolidays.pl | 3 +++ > tools/newHolidays.pl | 2 ++ > 2 files changed, 5 insertions(+) > >diff --git a/tools/exceptionHolidays.pl b/tools/exceptionHolidays.pl >index 90b17bc6cf..1f3b9672fb 100755 >--- a/tools/exceptionHolidays.pl >+++ b/tools/exceptionHolidays.pl >@@ -14,6 +14,9 @@ use Koha::DateUtils; > my $input = new CGI; > my $dbh = C4::Context->dbh(); > >+checkauth($input, 0, {tools=> 'edit_calendar'}, 'intranet'); >+ >+ > my $branchcode = $input->param('showBranchName'); > my $weekday = $input->param('showWeekday'); > my $day = $input->param('showDay'); >diff --git a/tools/newHolidays.pl b/tools/newHolidays.pl >index a161eaf1c8..f13e52447b 100755 >--- a/tools/newHolidays.pl >+++ b/tools/newHolidays.pl >@@ -33,6 +33,8 @@ use Koha::DateUtils; > my $input = new CGI; > my $dbh = C4::Context->dbh(); > >+checkauth($input, 0, {tools=> 'edit_calendar'}, 'intranet'); >+ > our $branchcode = $input->param('newBranchName'); > my $originalbranchcode = $branchcode; > our $weekday = $input->param('newWeekday'); >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 24878
:
100764
|
100837
|
100882
|
100883
|
100884