View | Details | Raw Unified | Return to bug 28959
Collapse All | Expand All

(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt (-3 / +3 lines)
Lines 16-25 Link Here
16
                        <li class="breadcrumb-item"><a href="/cgi-bin/koha/opac-user.pl">[% INCLUDE 'patron-title.inc' patron = logged_in_user %]</a></li>
16
                        <li class="breadcrumb-item"><a href="/cgi-bin/koha/opac-user.pl">[% INCLUDE 'patron-title.inc' patron = logged_in_user %]</a></li>
17
                    [% END %]
17
                    [% END %]
18
                    <li class="breadcrumb-item">
18
                    <li class="breadcrumb-item">
19
                        [% IF shelf.category == 1 %]
19
                        [% IF shelf.public %]
20
                            <a href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;public=0">Your lists</a>
21
                        [% ELSE %]
22
                            <a href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;public=1">Public lists</a>
20
                            <a href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;public=1">Public lists</a>
21
                        [% ELSE %]
22
                            <a href="/cgi-bin/koha/opac-shelves.pl?op=list&amp;public=0">Your lists</a>
23
                        [% END %]
23
                        [% END %]
24
                    </li>
24
                    </li>
25
                    <li class="breadcrumb-item active">
25
                    <li class="breadcrumb-item active">
(-)a/opac/opac-shareshelf.pl (-3 / +3 lines)
Lines 81-87 sub _init { Link Here
81
    $shelf = Koha::Virtualshelves->find( $shelfnumber ) unless $param->{errcode};
81
    $shelf = Koha::Virtualshelves->find( $shelfnumber ) unless $param->{errcode};
82
    $param->{shelfname} = $shelf ? $shelf->shelfname : q||;
82
    $param->{shelfname} = $shelf ? $shelf->shelfname : q||;
83
    $param->{owner}     = $shelf ? $shelf->owner : -1;
83
    $param->{owner}     = $shelf ? $shelf->owner : -1;
84
    $param->{category}  = $shelf ? $shelf->category : -1;
84
    $param->{public}    = $shelf ? $shelf->public : 0;
85
85
86
    load_template($param);
86
    load_template($param);
87
    return $param;
87
    return $param;
Lines 128-134 sub show_accept { Link Here
128
    # You must not be the owner and the list must be private
128
    # You must not be the owner and the list must be private
129
    if( !$shelf ) {
129
    if( !$shelf ) {
130
        $param->{errcode} = 2;
130
        $param->{errcode} = 2;
131
    } elsif( $shelf->category == 2 ) {
131
    } elsif( $shelf->public ) {
132
        $param->{errcode} = 5;
132
        $param->{errcode} = 5;
133
    } elsif( $shelf->owner == $param->{loggedinuser} ) {
133
    } elsif( $shelf->owner == $param->{loggedinuser} ) {
134
        $param->{errcode} = 8;
134
        $param->{errcode} = 8;
Lines 264-270 sub check_owner_category { Link Here
264
    #sharing user should be the owner
264
    #sharing user should be the owner
265
    #list should be private
265
    #list should be private
266
    $param->{errcode} = 4 if $param->{owner} != $param->{loggedinuser};
266
    $param->{errcode} = 4 if $param->{owner} != $param->{loggedinuser};
267
    $param->{errcode} = 5 if !$param->{errcode} && $param->{category} != 1;
267
    $param->{errcode} = 5 if !$param->{errcode} && $param->{public};
268
    return !defined $param->{errcode};
268
    return !defined $param->{errcode};
269
}
269
}
270
270
(-)a/t/db_dependent/selenium/regressions.t (-4 / +4 lines)
Lines 179-185 subtest 'XSS vulnerabilities in pagination' => sub { Link Here
179
            {
179
            {
180
                class => 'Koha::Virtualshelves',
180
                class => 'Koha::Virtualshelves',
181
                value => {
181
                value => {
182
                    category                 => 2,
182
                    public                   => 1,
183
                    allow_change_from_owner  => 1,
183
                    allow_change_from_owner  => 1,
184
                    allow_change_from_others => 0,
184
                    allow_change_from_others => 0,
185
                    owner                    => $patron->borrowernumber
185
                    owner                    => $patron->borrowernumber
Lines 193-199 subtest 'XSS vulnerabilities in pagination' => sub { Link Here
193
    $patron->set_password({ password => $password });
193
    $patron->set_password({ password => $password });
194
    $s->opac_auth( $patron->userid, $password );
194
    $s->opac_auth( $patron->userid, $password );
195
195
196
    my $public_lists = $s->opac_base_url . q|opac-shelves.pl?op=list&category=2|;
196
    my $public_lists = $s->opac_base_url . q|opac-shelves.pl?op=list&public=1|;
197
    $driver->get($public_lists);
197
    $driver->get($public_lists);
198
198
199
    $s->remove_error_handler;
199
    $s->remove_error_handler;
Lines 202-208 subtest 'XSS vulnerabilities in pagination' => sub { Link Here
202
    is( $alert_text, undef, 'No alert box displayed' );
202
    is( $alert_text, undef, 'No alert box displayed' );
203
203
204
    my $booh_alert = 'booh!';
204
    my $booh_alert = 'booh!';
205
    $public_lists = $s->opac_base_url . qq|opac-shelves.pl?op=list&category=2"><script>alert('$booh_alert')</script>|;
205
    $public_lists = $s->opac_base_url . qq|opac-shelves.pl?op=list&public=1"><script>alert('$booh_alert')</script>|;
206
    $driver->get($public_lists);
206
    $driver->get($public_lists);
207
207
208
    $s->remove_error_handler;
208
    $s->remove_error_handler;
Lines 211-217 subtest 'XSS vulnerabilities in pagination' => sub { Link Here
211
    is( $alert_text, undef, 'No alert box displayed, even if evil intent' );
211
    is( $alert_text, undef, 'No alert box displayed, even if evil intent' );
212
212
213
    my $second_page = $driver->find_element('//div[@class="pages"]/span[@class="currentPage"]/following-sibling::a');
213
    my $second_page = $driver->find_element('//div[@class="pages"]/span[@class="currentPage"]/following-sibling::a');
214
    like( $second_page->get_attribute('href'), qr{(?|&)category=2(&|$)}, 'The second page should display category without the invalid value' );
214
    like( $second_page->get_attribute('href'), qr{(?|&)public=1(&|$)}, 'The second page should display category without the invalid value' );
215
215
216
    push @cleanup, $patron, $patron->category, $patron->library;
216
    push @cleanup, $patron, $patron->category, $patron->library;
217
217
(-)a/virtualshelves/addbybiblionumber.pl (-9 / +8 lines)
Lines 44-52 addbybiblionumber.pl Link Here
44
    if this parameter exists, then it must be equals to the name of the shelf
44
    if this parameter exists, then it must be equals to the name of the shelf
45
    to add.
45
    to add.
46
46
47
=item category
47
=item public
48
48
49
    if this script has to add a shelf, it add one with this category.
49
    if this script has to add a shelf, it adds one with this 'public' setting.
50
50
51
=item newshelf
51
=item newshelf
52
52
Lines 69-75 my $query = CGI->new; Link Here
69
my $shelfnumber     = $query->param('shelfnumber');
69
my $shelfnumber     = $query->param('shelfnumber');
70
my $newvirtualshelf = $query->param('newvirtualshelf');
70
my $newvirtualshelf = $query->param('newvirtualshelf');
71
my $newshelf        = $query->param('newshelf');
71
my $newshelf        = $query->param('newshelf');
72
my $category        = $query->param('category');
72
my $public          = $query->param('public');
73
my $sortfield       = $query->param('sortfield');
73
my $sortfield       = $query->param('sortfield');
74
my $confirmed       = $query->param('confirmed') || 0;
74
my $confirmed       = $query->param('confirmed') || 0;
75
my ( $errcode, $authorized ) = ( 0, 1 );
75
my ( $errcode, $authorized ) = ( 0, 1 );
Lines 95-101 if ($newvirtualshelf) { Link Here
95
        Koha::Virtualshelf->new(
95
        Koha::Virtualshelf->new(
96
            {
96
            {
97
                shelfname => $newvirtualshelf,
97
                shelfname => $newvirtualshelf,
98
                category  => $category,
98
                public    => $public,
99
                sortfield => $sortfield,
99
                sortfield => $sortfield,
100
                owner     => $loggedinuser,
100
                owner     => $loggedinuser,
101
            }
101
            }
Lines 149-169 if ($newvirtualshelf) { Link Here
149
149
150
} else {
150
} else {
151
    my $private_shelves = Koha::Virtualshelves->search(
151
    my $private_shelves = Koha::Virtualshelves->search(
152
        {   category => 1,
152
        {   public                  => 0,
153
            owner    => $loggedinuser,
153
            owner                   => $loggedinuser,
154
            allow_change_from_owner => 1,
154
            allow_change_from_owner => 1,
155
        },
155
        },
156
        { order_by => 'shelfname' }
156
        { order_by => 'shelfname' }
157
    );
157
    );
158
    my $shelves_shared_with_me = Koha::Virtualshelves->search(
158
    my $shelves_shared_with_me = Koha::Virtualshelves->search(
159
        {   category                            => 1,
159
        {   public                              => 0,
160
            'virtualshelfshares.borrowernumber' => $loggedinuser,
160
            'virtualshelfshares.borrowernumber' => $loggedinuser,
161
            allow_change_from_others            => 1,
161
            allow_change_from_others            => 1,
162
        },
162
        },
163
        { join => 'virtualshelfshares', }
163
        { join => 'virtualshelfshares', }
164
    );
164
    );
165
    my $public_shelves = Koha::Virtualshelves->search(
165
    my $public_shelves = Koha::Virtualshelves->search(
166
        {   category => 2,
166
        {   public   => 1,
167
            -or      => [
167
            -or      => [
168
                -and => {
168
                -and => {
169
                    allow_change_from_owner => 1,
169
                    allow_change_from_owner => 1,
170
- 

Return to bug 28959