From 88e1e6a34bd88f3406fbddbbbb8ad5bd5cc636ac Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Wed, 5 Jan 2022 15:56:24 +0100
Subject: [PATCH] Bug 29542: Prevent access to private list to non authorized
users
The catalogue permission is not enough.
Test plan:
Create a private list owned by user A
Login with user B and hit (with XX the shelfid)
/cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX
You should get an error message "You do not have sufficient permission
to continue."
Login with user A
=> You should be able to send the list
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
---
.../prog/en/modules/virtualshelves/sendshelfform.tt | 1 +
virtualshelves/sendshelf.pl | 13 +++++++++----
2 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
index c8ebd595f0..d607578c7c 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
@@ -3,6 +3,7 @@
[% INCLUDE 'doc-head-close.inc' %]
</head>
<body id="lists_sendshelfform" class="lists" style="padding: 1em;">
+[% INCLUDE 'blocking_errors.inc' %]
<div class="container">[% IF ( email ) %]
[% IF ( SENT ) %]
diff --git a/virtualshelves/sendshelf.pl b/virtualshelves/sendshelf.pl
index 06649a9889..504481b6ca 100755
--- a/virtualshelves/sendshelf.pl
+++ b/virtualshelves/sendshelf.pl
@@ -31,13 +31,16 @@ use C4::Biblio qw(
GetMarcSubjects
);
use C4::Items qw( GetItemsInfo );
-use C4::Output qw( output_html_with_http_headers );
+use C4::Output qw(
+ output_html_with_http_headers
+ output_and_exit
+);
use Koha::Email;
use Koha::Virtualshelves;
my $query = CGI->new;
-my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
+my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
{
template_name => "virtualshelves/sendshelfform.tt",
query => $query,
@@ -49,7 +52,10 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
my $shelfid = $query->param('shelfid');
my $to_address = $query->param('email');
-my $dbh = C4::Context->dbh;
+my $shelf = Koha::Virtualshelves->find( $shelfid );
+
+output_and_exit( $query, $cookie, $template, 'insufficient_permission' )
+ if $shelf && !$shelf->can_be_viewed( $loggedinuser );
if ($to_address) {
my $comment = $query->param('comment');
@@ -63,7 +69,6 @@ if ($to_address) {
}
);
- my $shelf = Koha::Virtualshelves->find( $shelfid );
my $contents = $shelf->get_contents;
my $marcflavour = C4::Context->preference('marcflavour');
my $iso2709;
--
2.30.2