Bugzilla – Attachment 129335 Details for
Bug 29542
User with 'catalogue' permission can view everybody's (private) virtualshelves
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29542: Prevent access to private list to non authorized users
Bug-29542-Prevent-access-to-private-list-to-non-au.patch (text/plain), 2.84 KB, created by
Tomás Cohen Arazi
on 2022-01-12 12:21:47 UTC
(
hide
)
Description:
Bug 29542: Prevent access to private list to non authorized users
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi
Created:
2022-01-12 12:21:47 UTC
Size:
2.84 KB
patch
obsolete
>From 92c3eaf91949db822d9aab43ff771ec4a890c987 Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 5 Jan 2022 15:56:24 +0100 >Subject: [PATCH] Bug 29542: Prevent access to private list to non authorized > users > >The catalogue permission is not enough. > >Test plan: >Create a private list owned by user A >Login with user B and hit (with XX the shelfid) > /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX > >You should get an error message "You do not have sufficient permission >to continue." > >Login with user A >=> You should be able to send the list > >Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > .../prog/en/modules/virtualshelves/sendshelfform.tt | 1 + > virtualshelves/sendshelf.pl | 13 +++++++++---- > 2 files changed, 10 insertions(+), 4 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt >index c8ebd595f0..d607578c7c 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt >@@ -3,6 +3,7 @@ > [% INCLUDE 'doc-head-close.inc' %] > </head> > <body id="lists_sendshelfform" class="lists" style="padding: 1em;"> >+[% INCLUDE 'blocking_errors.inc' %] > <div class="container">[% IF ( email ) %] > > [% IF ( SENT ) %] >diff --git a/virtualshelves/sendshelf.pl b/virtualshelves/sendshelf.pl >index 06649a9889..504481b6ca 100755 >--- a/virtualshelves/sendshelf.pl >+++ b/virtualshelves/sendshelf.pl >@@ -31,13 +31,16 @@ use C4::Biblio qw( > GetMarcSubjects > ); > use C4::Items qw( GetItemsInfo ); >-use C4::Output qw( output_html_with_http_headers ); >+use C4::Output qw( >+ output_html_with_http_headers >+ output_and_exit >+); > use Koha::Email; > use Koha::Virtualshelves; > > my $query = CGI->new; > >-my ( $template, $borrowernumber, $cookie ) = get_template_and_user( >+my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > { > template_name => "virtualshelves/sendshelfform.tt", > query => $query, >@@ -49,7 +52,10 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user( > my $shelfid = $query->param('shelfid'); > my $to_address = $query->param('email'); > >-my $dbh = C4::Context->dbh; >+my $shelf = Koha::Virtualshelves->find( $shelfid ); >+ >+output_and_exit( $query, $cookie, $template, 'insufficient_permission' ) >+ if $shelf && !$shelf->can_be_viewed( $loggedinuser ); > > if ($to_address) { > my $comment = $query->param('comment'); >@@ -63,7 +69,6 @@ if ($to_address) { > } > ); > >- my $shelf = Koha::Virtualshelves->find( $shelfid ); > my $contents = $shelf->get_contents; > my $marcflavour = C4::Context->preference('marcflavour'); > my $iso2709; >-- >2.32.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29542
:
127914
|
129030
|
129108
| 129335