From 128a57f7b23ca36c032a2f88e20ee4ef9571bc16 Mon Sep 17 00:00:00 2001 From: Alexandre Noel Date: Fri, 28 Jun 2024 11:43:55 -0400 Subject: [PATCH] Bug 13342 - Not logged in user can place a review/comment as a deleted patron I find out the post comments page allows not logged in user, so I simply deleted the relevant line. 1. Apply the patch 2. Log in to OPAC. 3. Find a Biblio and open the comments tab. 4. Open another tab/window, and log out from that page. 5. Return to the first page. 6. Click "Post your comments on this title." --> You should be redirected to the login page in a new window. 7. In the new window, log in again. 8. Write a comment but don't submit it. 9. In the seconf tab, log out from the account. 10. Return to the form post comments and click "Submit and close this window" --> You should be redirected to the login page. --- opac/opac-review.pl | 62 ++++++++++++++++++++++----------------------- 1 file changed, 31 insertions(+), 31 deletions(-) diff --git a/opac/opac-review.pl b/opac/opac-review.pl index e948e1cf16..6105387896 100755 --- a/opac/opac-review.pl +++ b/opac/opac-review.pl @@ -36,62 +36,62 @@ my $op = $query->param('op') // q{}; my ( $template, $borrowernumber, $cookie ) = get_template_and_user( { - template_name => "opac-review.tt", - query => $query, - type => "opac", - authnotrequired => ( C4::Context->preference("OpacPublic") ? 1 : 0 ), + template_name => "opac-review.tt", + query => $query, + type => "opac", } ); # FIXME: need to allow user to delete their own comment(s) my ( $clean, @errors, $savedreview ); -my $biblio = Koha::Biblios->find( $biblionumber ); +my $biblio = Koha::Biblios->find($biblionumber); -if( !$biblio ) { +if ( !$biblio ) { push @errors, { nobiblio => 1 }; -} elsif( $reviewid ) { # edit existing one, check on creator - $savedreview = Koha::Reviews->search({ reviewid => $reviewid, borrowernumber => $borrowernumber })->next; +} elsif ($reviewid) { # edit existing one, check on creator + $savedreview = Koha::Reviews->search( { reviewid => $reviewid, borrowernumber => $borrowernumber } )->next; push @errors, { unauthorized => 1 } if !$savedreview; -} else { # this check prevents adding multiple comments - # FIXME biblionumber, borrowernumber should be a unique key of reviews - $savedreview = Koha::Reviews->search({ biblionumber => $biblionumber, borrowernumber => $borrowernumber })->next; - $review = $savedreview? $savedreview->review: $review; +} else { # this check prevents adding multiple comments + # FIXME biblionumber, borrowernumber should be a unique key of reviews + $savedreview = Koha::Reviews->search( { biblionumber => $biblionumber, borrowernumber => $borrowernumber } )->next; + $review = $savedreview ? $savedreview->review : $review; } -if( $op =~ /^cud-/ && !@errors && defined $review ) { - if ($review !~ /\S/) { - push @errors, {empty=>1}; - } else { - $clean = C4::Scrubber->new('comment')->scrub($review); - if ($clean !~ /\S/) { - push @errors, {scrubbed_all=>1}; - } else { - if ($clean ne $review) { - push @errors, {scrubbed=>$clean}; - } +if ( $op =~ /^cud-/ && !@errors && defined $review ) { + if ( $review !~ /\S/ ) { + push @errors, { empty => 1 }; + } else { + $clean = C4::Scrubber->new('comment')->scrub($review); + if ( $clean !~ /\S/ ) { + push @errors, { scrubbed_all => 1 }; + } else { + if ( $clean ne $review ) { + push @errors, { scrubbed => $clean }; + } if ($savedreview) { $savedreview->set( { - review => $clean, - approved => 0, - datereviewed => dt_from_string + review => $clean, + approved => 0, + datereviewed => dt_from_string } )->store; } else { $reviewid = Koha::Review->new( - { biblionumber => $biblionumber, + { + biblionumber => $biblionumber, borrowernumber => $borrowernumber, review => $clean, datereviewed => dt_from_string } )->store->reviewid; } - unless (@errors){ $template->param(WINDOW_CLOSE=>1); } - } - } + unless (@errors) { $template->param( WINDOW_CLOSE => 1 ); } + } + } } -(@errors ) and $template->param( ERRORS=>\@errors); +(@errors) and $template->param( ERRORS => \@errors ); $review = $clean; $review ||= $savedreview->review if $savedreview; $template->param( -- 2.34.1