From dda9348261279abda7e15ae4643c4851ff37e498 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Mon, 20 Jul 2020 09:44:05 +0100 Subject: [PATCH] Bug 26023: Properly secure the cashup action for libraries The libraries summary page for cash management is available for users wit the 'anonymous_refund' permission to allow them to navigate to alternate cash registers and search for the prior transaction to refund. However, currently the cashup option appears, and is not blocked at the server, for all user who may access the page. It should be blocked for those users without the 'cashup' permission. --- .../prog/en/modules/pos/registers.tt | 20 ++++++++++++- pos/registers.pl | 29 +++++++++++-------- 2 files changed, 36 insertions(+), 13 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt index 026dd1c9fa..384bae596c 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt @@ -25,9 +25,18 @@ can record payments. [% ELSE %] + + [% IF ( error_cashup_permission ) %] +
+ You do not have permission to perform cashup actions. +
+ [% END %] + + [% IF CAN_user_cash_management_cashup %]
+ [% END %]

Library transaction details for [% library.branchname | html %]

@@ -47,7 +56,9 @@ Bankable Income (cash) Outgoing (cash) + [% IF CAN_user_cash_management_cashup %] Actions + [% END %] [% SET bankable = 0, ctotal = 0, dtotal = 0, cctotal = 0, cdtotal = 0 %] @@ -81,9 +92,12 @@ [% rdtotal | $Price %] ([% rcdtotal | $Price %]) [% SET dtotal = dtotal + rdtotal %] [% SET cdtotal = cdtotal + rcdtotal %] + + [% IF CAN_user_cash_management_cashup %] + [% END %] [% END %] @@ -93,7 +107,11 @@ [% bankable | $Price %] [% ctotal | $Price %] ([% cctotal | $Price %]) [% dtotal | $Price %] ([% cdtotal | $Price %]) - + [% IF CAN_user_cash_management_cashup %] + + + + [% END %] diff --git a/pos/registers.pl b/pos/registers.pl index 620b45dbab..c644ebc585 100755 --- a/pos/registers.pl +++ b/pos/registers.pl @@ -55,18 +55,10 @@ else { my $op = $input->param('op') // ''; if ( $op eq 'cashup' ) { - my $registerid = $input->param('registerid'); - if ($registerid) { - my $register = Koha::Cash::Registers->find( { id => $registerid } ); - $register->add_cashup( - { - manager_id => $logged_in_user->id, - amount => $register->outstanding_accountlines->total - } - ); - } - else { - for my $register ( $registers->as_list ) { + if ( $logged_in_user->has_permission( { cash_management => 'cashup' } ) ) { + my $registerid = $input->param('registerid'); + if ($registerid) { + my $register = Koha::Cash::Registers->find( { id => $registerid } ); $register->add_cashup( { manager_id => $logged_in_user->id, @@ -74,6 +66,19 @@ if ( $op eq 'cashup' ) { } ); } + else { + for my $register ( $registers->as_list ) { + $register->add_cashup( + { + manager_id => $logged_in_user->id, + amount => $register->outstanding_accountlines->total + } + ); + } + } + } + else { + $template->param( error_cashup_permission => 1 ); } } -- 2.20.1