Bugzilla – Attachment 40963 Details for
Bug 11590
Restrict the actions for the DB user
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 11590: Restrict the actions for the DB user
Bug-11590-Restrict-the-actions-for-the-DB-user.patch (text/plain), 14.05 KB, created by
Jonathan Druart
on 2015-07-13 08:21:52 UTC
(
hide
)
Description:
Bug 11590: Restrict the actions for the DB user
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2015-07-13 08:21:52 UTC
Size:
14.05 KB
patch
obsolete
>From fc7e4116e3305b0b895e22e79cdeb4f6f2b33a5f Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Fri, 10 Jul 2015 18:13:30 +0100 >Subject: [PATCH] Bug 11590: Restrict the actions for the DB user > >The DB user (the one defined in the KOHA_CONF file, section config) >should not be used to navigate into Koha. >It has been decided to let it actif to create the first user easily. >This patch suggests to restrict as much as possible the actions for this >user. If logged with this user, the administrator will only be able to >create the first user and that's all. >Automatically the new user created will be a superlibrarian. > >Test plan: >1/ Use the DB user to log you in into Koha. >2/ Make sure you are just able to go to the about and help pages. >On the main page, you are pleased to create an user. >3/ Click on the link to create a new user >4/ Fill the form and save >5/ You are redirected to the loggin page >6/ Use the new user credentials and confirm it has been created as a >superlibrarian. >--- > C4/Auth.pm | 22 ++++++++++------- > about.pl | 2 +- > .../intranet-tmpl/prog/en/includes/header.inc | 28 +++++++++++++--------- > koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt | 4 ++++ > .../intranet-tmpl/prog/en/modules/intranet-main.tt | 7 +++++- > mainpage.pl | 2 +- > members/memberentry.pl | 15 ++++++++++-- > 7 files changed, 56 insertions(+), 24 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 268ef35..0f9da8c 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -976,7 +976,7 @@ sub checkauth { > } > } > >- # $return: 1 = valid user, 2 = superlibrarian >+ # $return: 1 = valid user, 2 = DB user > if ($return) { > > #_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); >@@ -1073,7 +1073,8 @@ sub checkauth { > } > elsif ( $return == 2 ) { > >- #We suppose the user is the superlibrarian >+ # It's the DB user, again! >+ # He won't be able to do something interesting > $borrowernumber = 0; > $session->param( 'number', 0 ); > $session->param( 'id', C4::Context->config('user') ); >@@ -1082,7 +1083,7 @@ sub checkauth { > $session->param( 'surname', C4::Context->config('user') ); > $session->param( 'branch', 'NO_LIBRARY_SET' ); > $session->param( 'branchname', 'NO_LIBRARY_SET' ); >- $session->param( 'flags', 1 ); >+ $session->param( 'flags', 0 ); > $session->param( 'emailaddress', C4::Context->preference('KohaAdminEmailAddress') ); > $session->param( 'ip', $session->remote_addr() ); > $session->param( 'lasttime', time() ); >@@ -1203,6 +1204,7 @@ sub checkauth { > PatronSelfRegistrationDefaultCategory => C4::Context->preference("PatronSelfRegistrationDefaultCategory"), > persona => C4::Context->preference("Persona"), > opac_css_override => $ENV{'OPAC_CSS_OVERRIDE'}, >+ user_added => $query->param('user_added'), > ); > > $template->param( OpacPublic => C4::Context->preference("OpacPublic") ); >@@ -1499,7 +1501,8 @@ sub check_api_auth { > $session->param( 'lasttime', time() ); > } elsif ( $return == 2 ) { > >- #We suppose the user is the superlibrarian >+ # It's the DB user, again! >+ # He won't be able to do something interesting > $session->param( 'number', 0 ); > $session->param( 'id', C4::Context->config('user') ); > $session->param( 'cardnumber', C4::Context->config('user') ); >@@ -1507,7 +1510,7 @@ sub check_api_auth { > $session->param( 'surname', C4::Context->config('user') ); > $session->param( 'branch', 'NO_LIBRARY_SET' ); > $session->param( 'branchname', 'NO_LIBRARY_SET' ); >- $session->param( 'flags', 1 ); >+ $session->param( 'flags', 0 ); > $session->param( 'emailaddress', C4::Context->preference('KohaAdminEmailAddress') ); > $session->param( 'ip', $session->remote_addr() ); > $session->param( 'lasttime', time() ); >@@ -1934,9 +1937,12 @@ sub haspermission { > my $row = $sth->fetchrow(); > my $flags = getuserflags( $row, $userid ); > if ( $userid eq C4::Context->config('user') ) { >- >- # Super User Account from /etc/koha.conf >- $flags->{'superlibrarian'} = 1; >+ # DB User Account from /etc/koha.conf >+ if ( $flagsrequired->{DB_user} == 1 ) { >+ $flags->{DB_user} = 1; >+ return $flags; >+ } >+ return 0; > } > elsif ( $userid eq 'demo' && C4::Context->config('demo') ) { > >diff --git a/about.pl b/about.pl >index 4e06ae5..734b7d8 100755 >--- a/about.pl >+++ b/about.pl >@@ -44,7 +44,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( > query => $query, > type => "intranet", > authnotrequired => 0, >- flagsrequired => { catalogue => 1 }, >+ flagsrequired => { catalogue => 1, DB_user => 1 }, > debug => 1, > } > ); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc >index e4caee8..db22795 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc >@@ -5,21 +5,25 @@ > [% IF ( CAN_user_circulate ) %]<li><a href="/cgi-bin/koha/circ/circulation-home.pl">Circulation</a></li>[% END %] > [% IF ( CAN_user_borrowers ) %]<li><a href="/cgi-bin/koha/members/members-home.pl">Patrons</a></li>[% END %] > [% IF ( CAN_user_catalogue ) %]<li><a href="/cgi-bin/koha/catalogue/search.pl">Search</a></li>[% END %] >- [% IF ( intranetbookbag ) %] >+ [% IF ( intranetbookbag and loggedinusernumber) %] > <li><a href="#" id="cartmenulink">Cart<span id="basketcount"></span></a></li> > [% END %] > [% IntranetNav %] > <li class="dropdown"> > <a href="#" class="dropdown-toggle" data-toggle="dropdown">More <b class="caret"></b></a> > <ul class="dropdown-menu"> >+ [% IF ( loggedinusernumber ) %] > <li><a href="/cgi-bin/koha/virtualshelves/shelves.pl">Lists</a></li> >+ [% END %] > [% IF ( CAN_user_editcatalogue_edit_catalogue || CAN_user_editcatalogue_edit_items ) %] > <li><a href="/cgi-bin/koha/cataloguing/addbooks.pl">Cataloging</a></li> > [% END %] > [% IF ( CAN_user_acquisition ) %] > <li><a href="/cgi-bin/koha/acqui/acqui-home.pl">Acquisitions</a></li> > [% END %] >+ [% IF ( loggedinusernumber ) %] > <li><a href="/cgi-bin/koha/authorities/authorities-home.pl">Authorities</a></li> >+ [% END %] > [% IF ( CAN_user_serials ) %] > <li><a href="/cgi-bin/koha/serials/serials-home.pl">Serials</a></li> > [% END %] >@@ -62,18 +66,20 @@ > <b class="caret"></b> > </a> > <ul class="dropdown-menu" role="menu" aria-labelledby="drop3"> >- [% IF ( IndependentBranches ) %] >- [% IF ( CAN_user_management || CAN_user_editcatalogue_edit_catalogue ) %] >- <li> >- <a class="toplinks" href="/cgi-bin/koha/circ/selectbranchprinter.pl">Set library</a> >- </li> >+ [% IF loggedinusernumber %] >+ [% IF ( IndependentBranches ) %] >+ [% IF ( CAN_user_management || CAN_user_editcatalogue_edit_catalogue ) %] >+ <li> >+ <a class="toplinks" href="/cgi-bin/koha/circ/selectbranchprinter.pl">Set library</a> >+ </li> >+ [% END %] >+ [% ELSE %] >+ <li> >+ <a class="toplinks" href="/cgi-bin/koha/circ/selectbranchprinter.pl">Set library</a> >+ </li> > [% END %] >- [% ELSE %] >- <li> >- <a class="toplinks" href="/cgi-bin/koha/circ/selectbranchprinter.pl">Set library</a> >- </li> > [% END %] >- [% IF EnableSearchHistory %] >+ [% IF EnableSearchHistory and loggedinusernumber %] > <li> > <a class="toplinks" href="/cgi-bin/koha/catalogue/search-history.pl">Search history</a> > </li> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >index 9ae147e..e490e79 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >@@ -39,6 +39,10 @@ > <div id="login_error"><strong>Error: </strong>Invalid username or password</div> > [% END %] > >+[% IF user_added %] >+<div id="login_info"><strong>Info: </strong>The account has been correctly created, use it to continue.</div> >+[% END %] >+ > <!-- login prompt time--> > <form action="[% url %]" method="post" name="loginform" id="loginform"> > <input type="hidden" name="koha_login_context" value="intranet" /> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt >index 8440526..d0fc021 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt >@@ -19,7 +19,7 @@ > [% IF adminWarning %] > <div id="adminwarning" class="dialog alert"> > <p><strong>Warning:</strong> You're logged in with the database administrator account. This is a bad idea, and you are likely to encounter problems.</p> >- <p>You should <a href="/cgi-bin/koha/members/members-home.pl">create a patron</a> to use when administering Koha and give it superlibrarian permissions.</p> >+ <p>You should <a href="/cgi-bin/koha/members/memberentry.pl?op=add">create a patron</a> to use when administering Koha and give it superlibrarian permissions.</p> > </div> > [% END %] > <div class="yui-u first"> >@@ -44,9 +44,11 @@ > </li> > [% END %] > >+ [% IF ( CAN_user_catalogue ) %] > <li> > <a class="icon_general icon_lists" href="/cgi-bin/koha/virtualshelves/shelves.pl">Lists</a> > </li> >+ [% END %] > > [% IF ( UseCourseReserves ) %] > <li> >@@ -59,9 +61,12 @@ > <a class="icon_general icon_cataloging" href="/cgi-bin/koha/cataloguing/addbooks.pl">Cataloging</a> > </li> > [% END %] >+ >+ [% IF ( CAN_user_catalogue ) %] > <li> > <a class="icon_general icon_authorities" href="/cgi-bin/koha/authorities/authorities-home.pl">Authorities</a> > </li> >+ [% END %] > </ul> > </div><!-- /area-list-left --> > </div><!-- /yui-u first --> >diff --git a/mainpage.pl b/mainpage.pl >index 1ccffad..f0cf35c 100755 >--- a/mainpage.pl >+++ b/mainpage.pl >@@ -39,7 +39,7 @@ my ( $template, $loggedinuser, $cookie, $flags ) = get_template_and_user( > query => $query, > type => "intranet", > authnotrequired => 0, >- flagsrequired => { catalogue => 1, }, >+ flagsrequired => { catalogue => 1, DB_user => 1 }, > } > ); > >diff --git a/members/memberentry.pl b/members/memberentry.pl >index 514bdd8..ded7ae6 100755 >--- a/members/memberentry.pl >+++ b/members/memberentry.pl >@@ -60,12 +60,12 @@ my %data; > > my $dbh = C4::Context->dbh; > >-my ($template, $loggedinuser, $cookie) >+my ($template, $loggedinuser, $cookie, $flags) > = get_template_and_user({template_name => "members/memberentrygen.tt", > query => $input, > type => "intranet", > authnotrequired => 0, >- flagsrequired => {borrowers => 1}, >+ flagsrequired => {borrowers => 1, DB_user => 1}, > debug => ($debug) ? 1 : 0, > }); > >@@ -365,6 +365,10 @@ $nok = $nok || scalar(@errors); > if ((!$nok) and $nodouble and ($op eq 'insert' or $op eq 'save')){ > $debug and warn "$op dates: " . join "\t", map {"$_: $newdata{$_}"} qw(dateofbirth dateenrolled dateexpiry); > if ($op eq 'insert'){ >+ # It's a patron created by the DB user, set him the superlibrarian permissions >+ if ( $flags->{DB_user} == 1 ) { >+ $newdata{flags} = 1 >+ } > # we know it's not a duplicate borrowernumber or there would already be an error > $borrowernumber = &AddMember(%newdata); > $newdata{'borrowernumber'} = $borrowernumber; >@@ -429,6 +433,13 @@ if ((!$nok) and $nodouble and ($op eq 'insert' or $op eq 'save')){ > C4::Form::MessagingPreferences::handle_form_action($input, { borrowernumber => $borrowernumber }, $template); > } > } >+ >+ # The DB user has added the user, he can be logged out. >+ if ( $flags->{DB_user} == 1 ) { >+ print $input->redirect("/cgi-bin/koha/mainpage.pl?logout.x=1&user_added=1"); >+ exit; >+ } >+ > print scalar ($destination eq "circ") ? > $input->redirect("/cgi-bin/koha/circ/circulation.pl?borrowernumber=$borrowernumber") : > $input->redirect("/cgi-bin/koha/members/moremember.pl?borrowernumber=$borrowernumber") ; >-- >2.1.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 11590
:
24595
| 40963 |
48788