From d37e7f7c6d79aa0a7120cd7d6603108a21379367 Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Mon, 17 Aug 2015 12:26:44 +0200 Subject: [PATCH] Bug 14321: Fix permissions check in upload-file.pl Content-Type: text/plain; charset=utf-8 This fixes an error in one of the patches of bug 6874. The userid of the Koha admin user is passed to haspermission, but we should pick the userid from the session. NOTE: Bug 14686 will add a specific permission for tools/upload.pl. At that time we can add the script to the Tools menu too. For now, you need edit_catalogue to start upload.pl and you will additionally need a permission like upload_local_cover_images (see tools/upload-file) to successfully upload a new file. Searching for files and copying URLs to the editor can still be done with edit_catalogue. Test plan: [1] Pick a staff user that only has catalogue and edit_catalogue. [2] Without this patch, you can upload a file on tools/upload.pl. [3] Apply this patch. [4] Retry. Should not work: Upload status is Denied. [5] Login with enough permissions. Upload again. --- tools/upload-file.pl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/upload-file.pl b/tools/upload-file.pl index ffa9d30..e935751 100755 --- a/tools/upload-file.pl +++ b/tools/upload-file.pl @@ -48,15 +48,15 @@ my $sid = $cookies{'CGISESSID'}->value; my $auth_failure = 1; my ( $auth_status, $sessionID ) = check_cookie_auth( $sid ); +my $uid = C4::Auth::get_session($sid)->param('id'); foreach my $flag_required ( @{$flags_required} ) { - if ( my $flags = haspermission( C4::Context->config('user'), $flag_required ) ) { + if ( my $flags = haspermission( $uid, $flag_required ) ) { $auth_failure = 0 if $auth_status eq 'ok'; } } if ($auth_failure) { - $auth_status = 'denied' if $auth_status eq 'failed'; - send_reply( $auth_status ); + send_reply( 'denied' ); exit 0; } -- 1.7.10.4