From f1d65f206d6ca963e2cd4b9e7754c6691c7c659f Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Mon, 17 Aug 2015 12:26:44 +0200 Subject: [PATCH] Bug 14321: Fix permissions check in upload-file.pl Content-Type: text/plain; charset=utf-8 This fixes an error in one of the patches of bug 6874. The userid of the Koha admin user is passed to haspermission, but we should pick the userid from the session. NOTE: Bug 14686 will add a specific permission for tools/upload.pl. At that time we can add the script to the Tools menu too. For now, you need edit_catalogue to start upload.pl and you will additionally need a permission like upload_local_cover_images (see tools/upload-file) to successfully upload a new file. Searching for files and copying URLs to the editor can still be done with edit_catalogue. Test plan: [1] Pick a staff user that only has catalogue and edit_catalogue. [2] Without this patch, you can upload a file on tools/upload.pl. [3] Apply this patch. [4] Retry. Should not work: Upload status is Denied. [5] Login with enough permissions. Upload again. --- tools/upload-file.pl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/upload-file.pl b/tools/upload-file.pl index ffa9d30..e935751 100755 --- a/tools/upload-file.pl +++ b/tools/upload-file.pl @@ -48,15 +48,15 @@ my $sid = $cookies{'CGISESSID'}->value; my $auth_failure = 1; my ( $auth_status, $sessionID ) = check_cookie_auth( $sid ); +my $uid = C4::Auth::get_session($sid)->param('id'); foreach my $flag_required ( @{$flags_required} ) { - if ( my $flags = haspermission( C4::Context->config('user'), $flag_required ) ) { + if ( my $flags = haspermission( $uid, $flag_required ) ) { $auth_failure = 0 if $auth_status eq 'ok'; } } if ($auth_failure) { - $auth_status = 'denied' if $auth_status eq 'failed'; - send_reply( $auth_status ); + send_reply( 'denied' ); exit 0; } -- 1.7.10.4