Bugzilla – Attachment 127914 Details for
Bug 29542
User with 'catalogue' permission can view everybody's (private) virtualshelves
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29542: Check permission to view list in sendshelf
Bug-29542-Check-permission-to-view-list-in-sendshe.patch (text/plain), 1.35 KB, created by
Marcel de Rooy
on 2021-11-22 07:44:03 UTC
(
hide
)
Description:
Bug 29542: Check permission to view list in sendshelf
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2021-11-22 07:44:03 UTC
Size:
1.35 KB
patch
obsolete
>From 57466e36b7677bcbfcf496cbbe645615d6a7cc16 Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Mon, 22 Nov 2021 07:39:52 +0000 >Subject: [PATCH] Bug 29542: Check permission to view list in sendshelf >Content-Type: text/plain; charset=utf-8 > >Test plan: >Find a (private) list that you should not be able to view. >Try the URL /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=[list_number] >You should see an error message. (Which could surely be improved on >another report.) > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > virtualshelves/sendshelf.pl | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > >diff --git a/virtualshelves/sendshelf.pl b/virtualshelves/sendshelf.pl >index bc47249744..6543034215 100755 >--- a/virtualshelves/sendshelf.pl >+++ b/virtualshelves/sendshelf.pl >@@ -66,7 +66,15 @@ if ($to_address) { > ); > > my $shelf = Koha::Virtualshelves->find( $shelfid ); >- my $contents = $shelf->get_contents; >+ my $contents; >+ if( $shelf && $shelf->can_be_viewed($borrowernumber) ) { >+ $contents = $shelf->get_contents; >+ } else { >+ $template->param( error => 1, email => $to_address ); >+ output_html_with_http_headers $query, $cookie, $template->output; >+ exit; >+ } >+ > my $marcflavour = C4::Context->preference('marcflavour'); > my $iso2709; > my @results; >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29542
:
127914
|
129030
|
129108
|
129335