From db20010d7dc9c8049c885c1f823bee46fb96adab Mon Sep 17 00:00:00 2001 From: Hammat Wele Date: Wed, 4 Jun 2025 16:00:50 +0000 Subject: [PATCH] Bug 20956: BorrowersLog is not logging permission changes Changes to the flags field in the borrowers table are currently not logged in the Koha action_logs, making it impossible to trace changes to staff permissions. This represents a security issue. Test plan: 1. Go to a staff interface 2. Search for a patron and change their permissions (note their borrowernumber) 3. Go to tools/Log viewer 4. Filter by Module = Patrons, Object = borrowernumber. 5. Click on submit ==> No permission changes are logged. 6. Apply the patch 7. Repeat step 1, 2, 3, 4, 5 ==> Permission changes are now logged --- members/member-flags.pl | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/members/member-flags.pl b/members/member-flags.pl index ccc6092e6b..03722aab60 100755 --- a/members/member-flags.pl +++ b/members/member-flags.pl @@ -10,6 +10,8 @@ use CGI qw ( -utf8 ); use C4::Output qw( output_and_exit_if_error output_and_exit output_html_with_http_headers ); use C4::Auth qw( get_template_and_user get_all_subpermissions get_user_subpermissions ); use C4::Context; +use C4::Log qw( logaction ); +use JSON qw( to_json ); use Koha::Patron::Categories; use Koha::Patrons; @@ -89,6 +91,24 @@ if ( $op eq 'cud-newflags' ) { } $sth->execute( $module_flags, $member ); + # Actionlogs + if ( C4::Context->preference("BorrowersLog") ) { + my $info; + $info->{'flags'} = { + before => $old_flags, + after => $module_flags + }; + logaction( + "MEMBERS", + "MODIFY", + $member, + to_json( + $info, + { utf8 => 1, pretty => 1, canonical => 1 } + ) + ); + } + # deal with subpermissions $sth = $dbh->prepare("DELETE FROM user_permissions WHERE borrowernumber = ?"); $sth->execute($member); -- 2.34.1