From 0d428afa30783dbe477e1617edb5cd301696146a Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Wed, 19 Jan 2022 11:21:54 +0100 Subject: [PATCH] Bug 29903: Prevent messages to be deleted from unauthorised users The "Delete" link is hidden but the controller does not do the necessary checks. /cgi-bin/koha/circ/del_message.pl?message_id=1&borrowernumber=5&from=moremember Test plan: Create a message, see the "Delete" link, don't click it but copy it Change logged in library and use the link If AllowAllMessageDeletion is off you should be redirected to 403 --- circ/del_message.pl | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/circ/del_message.pl b/circ/del_message.pl index 778c4582268..e8c9f450f4d 100755 --- a/circ/del_message.pl +++ b/circ/del_message.pl @@ -39,6 +39,14 @@ my $borrowernumber = $input->param('borrowernumber'); my $message_id = $input->param('message_id'); my $message = Koha::Patron::Messages->find($message_id); +my $logged_in_patron = Koha::Patrons->find($loggedinuser); +if ( !C4::Context->preference('AllowAllMessageDeletion') + || $logged_in_patron->branchcode ne $message->branchcode ) +{ + print $input->redirect("/cgi-bin/koha/errors/403.pl"); + exit; +} + $message->delete if $message; if ( $input->param('from') eq "moremember" ) { -- 2.25.1