From fc7e4116e3305b0b895e22e79cdeb4f6f2b33a5f Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Fri, 10 Jul 2015 18:13:30 +0100 Subject: [PATCH] Bug 11590: Restrict the actions for the DB user The DB user (the one defined in the KOHA_CONF file, section config) should not be used to navigate into Koha. It has been decided to let it actif to create the first user easily. This patch suggests to restrict as much as possible the actions for this user. If logged with this user, the administrator will only be able to create the first user and that's all. Automatically the new user created will be a superlibrarian. Test plan: 1/ Use the DB user to log you in into Koha. 2/ Make sure you are just able to go to the about and help pages. On the main page, you are pleased to create an user. 3/ Click on the link to create a new user 4/ Fill the form and save 5/ You are redirected to the loggin page 6/ Use the new user credentials and confirm it has been created as a superlibrarian. --- C4/Auth.pm | 22 ++++++++++------- about.pl | 2 +- .../intranet-tmpl/prog/en/includes/header.inc | 28 +++++++++++++--------- koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt | 4 ++++ .../intranet-tmpl/prog/en/modules/intranet-main.tt | 7 +++++- mainpage.pl | 2 +- members/memberentry.pl | 15 ++++++++++-- 7 files changed, 56 insertions(+), 24 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 268ef35..0f9da8c 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -976,7 +976,7 @@ sub checkauth { } } - # $return: 1 = valid user, 2 = superlibrarian + # $return: 1 = valid user, 2 = DB user if ($return) { #_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); @@ -1073,7 +1073,8 @@ sub checkauth { } elsif ( $return == 2 ) { - #We suppose the user is the superlibrarian + # It's the DB user, again! + # He won't be able to do something interesting $borrowernumber = 0; $session->param( 'number', 0 ); $session->param( 'id', C4::Context->config('user') ); @@ -1082,7 +1083,7 @@ sub checkauth { $session->param( 'surname', C4::Context->config('user') ); $session->param( 'branch', 'NO_LIBRARY_SET' ); $session->param( 'branchname', 'NO_LIBRARY_SET' ); - $session->param( 'flags', 1 ); + $session->param( 'flags', 0 ); $session->param( 'emailaddress', C4::Context->preference('KohaAdminEmailAddress') ); $session->param( 'ip', $session->remote_addr() ); $session->param( 'lasttime', time() ); @@ -1203,6 +1204,7 @@ sub checkauth { PatronSelfRegistrationDefaultCategory => C4::Context->preference("PatronSelfRegistrationDefaultCategory"), persona => C4::Context->preference("Persona"), opac_css_override => $ENV{'OPAC_CSS_OVERRIDE'}, + user_added => $query->param('user_added'), ); $template->param( OpacPublic => C4::Context->preference("OpacPublic") ); @@ -1499,7 +1501,8 @@ sub check_api_auth { $session->param( 'lasttime', time() ); } elsif ( $return == 2 ) { - #We suppose the user is the superlibrarian + # It's the DB user, again! + # He won't be able to do something interesting $session->param( 'number', 0 ); $session->param( 'id', C4::Context->config('user') ); $session->param( 'cardnumber', C4::Context->config('user') ); @@ -1507,7 +1510,7 @@ sub check_api_auth { $session->param( 'surname', C4::Context->config('user') ); $session->param( 'branch', 'NO_LIBRARY_SET' ); $session->param( 'branchname', 'NO_LIBRARY_SET' ); - $session->param( 'flags', 1 ); + $session->param( 'flags', 0 ); $session->param( 'emailaddress', C4::Context->preference('KohaAdminEmailAddress') ); $session->param( 'ip', $session->remote_addr() ); $session->param( 'lasttime', time() ); @@ -1934,9 +1937,12 @@ sub haspermission { my $row = $sth->fetchrow(); my $flags = getuserflags( $row, $userid ); if ( $userid eq C4::Context->config('user') ) { - - # Super User Account from /etc/koha.conf - $flags->{'superlibrarian'} = 1; + # DB User Account from /etc/koha.conf + if ( $flagsrequired->{DB_user} == 1 ) { + $flags->{DB_user} = 1; + return $flags; + } + return 0; } elsif ( $userid eq 'demo' && C4::Context->config('demo') ) { diff --git a/about.pl b/about.pl index 4e06ae5..734b7d8 100755 --- a/about.pl +++ b/about.pl @@ -44,7 +44,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $query, type => "intranet", authnotrequired => 0, - flagsrequired => { catalogue => 1 }, + flagsrequired => { catalogue => 1, DB_user => 1 }, debug => 1, } ); diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc index e4caee8..db22795 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc @@ -5,21 +5,25 @@ [% IF ( CAN_user_circulate ) %]
  • Circulation
    • [% END %] [% IF ( CAN_user_borrowers ) %]
  • Patrons
    • [% END %] [% IF ( CAN_user_catalogue ) %]
  • Search
    • [% END %] - [% IF ( intranetbookbag ) %] + [% IF ( intranetbookbag and loggedinusernumber) %]
  • Cart
    • [% END %] [% IntranetNav %]
  • More