From d4d65f5f7f9083adc3d563b2bc72f09b6d2b8f78 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Fri, 3 Sep 2021 12:01:12 +0200 Subject: [PATCH] Bug 28947: Prevent OPAC user to create new users This patch prevents an existing user from exploiting the patron edit form in order to force create new patrons To test: 1 - Test with PatronSelfRegistration:Don't Allow PatronSelfRegistrationVerifyByEmail:Don't Require - sign in to opac - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - Fill out form - patron is created FAIL - sign out - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - you are sent to opac-main 2 - Test with PatronSelfRegistration:Don't Allow PatronSelfRegistrationVerifyByEmail:Require - sign in to opac - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - Fill out form - patron is sent email/will be created FAIL - sign out - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - you are sent to opac-main 3 - Test with PatronSelfRegistration:Allow PatronSelfRegistrationVerifyByEmail:Don't Require - sign in to opac - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - Fill out form - patron is created FAIL - sign out - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - patron is created OK 4 - Test with PatronSelfRegistration:Allow PatronSelfRegistrationVerifyByEmail:Require - sign in to opac - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - Fill out form - patron is sent email/will be created FAIL - sign out - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - patron is sent email/will be created OK 5 - APPLY PATCH 6 - Test with PatronSelfRegistration:Don't Allow PatronSelfRegistrationVerifyByEmail:Don't Require - sign in to opac - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - You are sent to opac-main - sign out - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - You are sent to opac-main 7 - Test with PatronSelfRegistration:Don't Allow PatronSelfRegistrationVerifyByEmail:Require - sign in to opac - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - You are sent to opac-main - sign out - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - You are sent to opac-main 8 - Test with PatronSelfRegistration:Allow PatronSelfRegistrationVerifyByEmail:Don't Require - sign in to opac - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - You are sent to opac-main - sign out - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - patron is created OK 9 - Test with PatronSelfRegistration:Allow PatronSelfRegistrationVerifyByEmail:Require - sign in to opac - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - You are sent to opac-main - sign out - go to http://kohadev.mydnsname.org:8080/cgi-bin/koha/opac-memberentry.pl?action=create - patron is sent email/will be created OK Signed-off-by: Nick Clemens --- opac/opac-memberentry.pl | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/opac/opac-memberentry.pl b/opac/opac-memberentry.pl index c940a6e1af..475ee6e943 100755 --- a/opac/opac-memberentry.pl +++ b/opac/opac-memberentry.pl @@ -64,6 +64,11 @@ unless ( C4::Context->preference('PatronSelfRegistration') || $borrowernumber ) } my $action = $cgi->param('action') || q{}; +if ( $borrowernumber && ( $action eq 'create' || $action eq 'new' ) ) { + print $cgi->redirect("/cgi-bin/koha/opac-main.pl"); + exit; +} + if ( $action eq q{} ) { if ($borrowernumber) { $action = 'edit'; -- 2.20.1