From b3864f484aadbcc37b8ae43163adc03b66b2fa1d Mon Sep 17 00:00:00 2001 From: Fridolin Somers Date: Tue, 23 Jun 2015 16:45:21 +0200 Subject: [PATCH] Bug 14440 - get_template_and_user can not have an empty template_name (updatesupplier.pl) Since Bug 14408, the method get_template_and_user can not have an empty template_name. Pages calling with an empty value should use C4::Auth::checkauth() This patch corrects acqui/updatesupplier.pl Test plan : - Apply patch - Connect to intranet with a user having "vendors_manage" permission - Go to acquisition module - Create a new vendor - Click on "Edit vendor" - Change some information and save => Your change is saved - Connect to intranet with a user not having "vendors_manage" permission - Try to access /cgi-bin/koha/acqui/updatesupplier.pl => Access is denied - Disconnect from intranet - Try to access /cgi-bin/koha/acqui/updatesupplier.pl => Access is denied --- acqui/updatesupplier.pl | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/acqui/updatesupplier.pl b/acqui/updatesupplier.pl index 65093d8..c064f76 100755 --- a/acqui/updatesupplier.pl +++ b/acqui/updatesupplier.pl @@ -59,15 +59,8 @@ use C4::Output; use CGI qw ( -utf8 ); my $input=new CGI; -my ($template, $loggedinuser, $cookie) = get_template_and_user( - { template_name => "", - query => $input, - type => "intranet", - authnotrequired => 0, - flagsrequired => { acquisition => 'vendors_manage' }, - debug => 1, - } -); + +checkauth( $input, 0, { acquisition => 'vendors_manage' }, 'intranet' ); #print $input->header(); my $booksellerid=$input->param('booksellerid'); -- 2.1.0