From c32e915293bcb07ec280dc0aea5b9ca845cef457 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc=20V=C3=A9ron?= Date: Fri, 12 Sep 2014 17:29:23 +0200 Subject: [PATCH] Bug 643: Followup: Encrypt param 'forceallow' to prevent unauthorized override The 'forceallow' param uses now an encrypted param based on session, logged-in user and borrower (instead of 1) --- circ/circulation.pl | 15 ++++++++++++--- .../intranet-tmpl/prog/en/modules/circ/circulation.tt | 12 ++++++------ 2 files changed, 18 insertions(+), 9 deletions(-) diff --git a/circ/circulation.pl b/circ/circulation.pl index 6c7529d..70d4342 100755 --- a/circ/circulation.pl +++ b/circ/circulation.pl @@ -51,7 +51,7 @@ use Date::Calc qw( Date_to_Days ); use List::MoreUtils qw/uniq/; - +use Digest::MD5 qw(md5_hex); # # PARAMETERS READING @@ -97,8 +97,6 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user ( my $branches = GetBranches(); -my $force_allow_issue = $query->param('forceallow') || 0; - my @failedrenews = $query->param('failedrenew'); # expected to be itemnumbers our %renew_failed = (); for (@failedrenews) { $renew_failed{$_} = 1; } @@ -217,8 +215,17 @@ if ($findborrower) { } # get the borrower information..... + +my $force_allow_issue = ''; +my $force_allow_code = ''; + my $borrower; if ($borrowernumber) { + + #Create an individual param for force allow + $force_allow_code = substr( md5_hex( $sessionID, $loggedinuser, $borrowernumber ), 5, 4); + $force_allow_issue = ($query->param('forceallow') eq $force_allow_code) || 0; + $borrower = GetMemberDetails( $borrowernumber, 0 ); my ( $od, $issue, $fines ) = GetMemberIssuesAndFines( $borrowernumber ); @@ -243,6 +250,7 @@ if ($borrowernumber) { flagged => "1", noissues => ($force_allow_issue) ? 0 : "1", forceallow => $force_allow_issue, + forceallowcode => $force_allow_code, expired => "1", renewaldate => format_date("$renew_year-$renew_month-$renew_day") ); @@ -408,6 +416,7 @@ foreach my $flag ( sort keys %$flags ) { $template->param( noissues => ($force_allow_issue) ? 0 : 'true', forceallow => $force_allow_issue, + forceallowcode => $force_allow_code, ); if ( $flag eq 'GNA' ) { $template->param( gna => 'true' ); diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt index ed404ad..0e8bbd8 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt @@ -250,7 +250,7 @@ $(document).ready(function() { [% IF CAN_user_circulate_force_checkout or HIGHHOLDS %]
-[% IF (forceallow) %][% END %] +[% IF (forceallow) %][% END %] [% IF ( RESERVED ) %]

@@ -291,7 +291,7 @@ $(document).ready(function() { [% END %] - [% IF (forceallow) %][% END %] + [% IF (forceallow) %][% END %] @@ -341,7 +341,7 @@ $(document).ready(function() { [% FOREACH book IN options %]
- [% IF (forceallow) %][% END %] + [% IF (forceallow) %][% END %] @@ -453,7 +453,7 @@ No patron matched [% message %]

Patron selection -[% IF (forceallow) %][% END %] +[% IF (forceallow) %][% END %] @@ -492,7 +492,7 @@ No patron matched [% message %] x [% END %] - [% IF (forceallow) %][% END %] + [% IF (forceallow) %][% END %] @@ -615,7 +615,7 @@ No patron matched [% message %] [% IF (noissues && borrowernumber && CAN_user_circulate_force_checkout) %] [% END %] -- 1.7.10.4