Bugzilla – Attachment 129594 Details for
Bug 29903
Message deletion possible from different branch
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29903: Prevent messages to be deleted from unauthorised users
Bug-29903-Prevent-messages-to-be-deleted-from-unau.patch (text/plain), 1.33 KB, created by
Jonathan Druart
on 2022-01-19 10:23:58 UTC
(
hide
)
Description:
Bug 29903: Prevent messages to be deleted from unauthorised users
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2022-01-19 10:23:58 UTC
Size:
1.33 KB
patch
obsolete
>From 0d428afa30783dbe477e1617edb5cd301696146a Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 19 Jan 2022 11:21:54 +0100 >Subject: [PATCH] Bug 29903: Prevent messages to be deleted from unauthorised > users > >The "Delete" link is hidden but the controller does not do the necessary checks. > >/cgi-bin/koha/circ/del_message.pl?message_id=1&borrowernumber=5&from=moremember > >Test plan: >Create a message, see the "Delete" link, don't click it but copy it >Change logged in library and use the link >If AllowAllMessageDeletion is off you should be redirected to 403 >--- > circ/del_message.pl | 8 ++++++++ > 1 file changed, 8 insertions(+) > >diff --git a/circ/del_message.pl b/circ/del_message.pl >index 778c4582268..e8c9f450f4d 100755 >--- a/circ/del_message.pl >+++ b/circ/del_message.pl >@@ -39,6 +39,14 @@ my $borrowernumber = $input->param('borrowernumber'); > my $message_id = $input->param('message_id'); > > my $message = Koha::Patron::Messages->find($message_id); >+my $logged_in_patron = Koha::Patrons->find($loggedinuser); >+if ( !C4::Context->preference('AllowAllMessageDeletion') >+ || $logged_in_patron->branchcode ne $message->branchcode ) >+{ >+ print $input->redirect("/cgi-bin/koha/errors/403.pl"); >+ exit; >+} >+ > $message->delete if $message; > > if ( $input->param('from') eq "moremember" ) { >-- >2.25.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29903
:
129594
|
129611
|
129613
|
129614