From a082fbe9581b03983f22cec34d8416499523ad6f Mon Sep 17 00:00:00 2001 From: Baptiste Wojtkowski Date: Wed, 3 Jul 2024 17:15:08 +0200 Subject: [PATCH] Bug 34971: Permission to close a serial subscription (edit) TEST PLAN (for 22.11): Before applying patch : 1 - log in as a user with only receive_serial right 2 - Select a serial 3 - Try to close it -> you can 4 - try to reopen the closed serial -> you can 5 - Make sure you have one opened and one closed serial Apply patch 6 - Try to close a serial -> you cannot 7 - Try to reopen a closed serial -> you cannot As a user that has the right delete_subscription: 8 - Try to delete the subscription -> you can (non regression test) Note -> on main this bug is less apparent because related buttons are hidden but you still can use routes with incorrect rights. Note : this should also be tested for superior version --- serials/subscription-detail.pl | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/serials/subscription-detail.pl b/serials/subscription-detail.pl index d033ab3..c32d65e 100755 --- a/serials/subscription-detail.pl +++ b/serials/subscription-detail.pl @@ -49,8 +49,19 @@ if ( $op and $op eq "cud-close" ) { # the subscription must be deletable if there is NO issues for a reason or another (should not happened, but...) # Permission needed if it is a deletion (del) : delete_subscription +# Permission needed if closing or reopenning : edit_subscription # Permission needed otherwise : * -my $permission = ($op eq "cud-del") ? "delete_subscription" : "*"; +my $permission; +if ( $op eq "cud-del" ) { + $permission = "delete_subscription"; +} +elsif ( $op eq "cud-reopen" || $op eq "cud-close" ) { + $permission = "edit_subscription"; +} +else { + $permission = "*"; +} + my ($template, $loggedinuser, $cookie) = get_template_and_user({template_name => "serials/subscription-detail.tt", -- 2.43.0