From c281a08bb83642e00c3536e9936c4312e4c87fc9 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Fri, 10 Jul 2015 18:13:30 +0100 Subject: [PATCH] [SIGNED-OFF] Bug 11590: Restrict the actions for the DB user The DB user (the one defined in the KOHA_CONF file, section config) should not be used to navigate into Koha. It has been decided to let it actif to create the first user easily. This patch suggests to restrict as much as possible the actions for this user. If logged with this user, the administrator will only be able to create the first user and that's all. Automatically the new user created will be a superlibrarian. Test plan: 1/ Use the DB user to log you in into Koha. 2/ Make sure you are just able to go to the about and help pages. On the main page, you are pleased to create an user. 3/ Click on the link to create a new user 4/ Fill the form and save 5/ You are redirected to the loggin page 6/ Use the new user credentials and confirm it has been created as a superlibrarian. Signed-off-by: Philippe Blouin --- C4/Auth.pm | 22 ++++++++++------- about.pl | 2 +- .../intranet-tmpl/prog/en/includes/header.inc | 28 +++++++++++++--------- koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt | 4 ++++ .../intranet-tmpl/prog/en/modules/intranet-main.tt | 7 +++++- mainpage.pl | 2 +- members/memberentry.pl | 15 ++++++++++-- 7 files changed, 56 insertions(+), 24 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 332b8c6..8bb17a3 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1018,7 +1018,7 @@ sub checkauth { } } - # $return: 1 = valid user, 2 = superlibrarian + # $return: 1 = valid user, 2 = DB user if ($return) { #_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); @@ -1115,7 +1115,8 @@ sub checkauth { } elsif ( $return == 2 ) { - #We suppose the user is the superlibrarian + # It's the DB user, again! + # He won't be able to do something interesting $borrowernumber = 0; $session->param( 'number', 0 ); $session->param( 'id', C4::Context->config('user') ); @@ -1124,7 +1125,7 @@ sub checkauth { $session->param( 'surname', C4::Context->config('user') ); $session->param( 'branch', 'NO_LIBRARY_SET' ); $session->param( 'branchname', 'NO_LIBRARY_SET' ); - $session->param( 'flags', 1 ); + $session->param( 'flags', 0 ); $session->param( 'emailaddress', C4::Context->preference('KohaAdminEmailAddress') ); $session->param( 'ip', $session->remote_addr() ); $session->param( 'lasttime', time() ); @@ -1246,6 +1247,7 @@ sub checkauth { PatronSelfRegistrationDefaultCategory => C4::Context->preference("PatronSelfRegistrationDefaultCategory"), persona => C4::Context->preference("Persona"), opac_css_override => $ENV{'OPAC_CSS_OVERRIDE'}, + user_added => $query->param('user_added'), ); $template->param( OpacPublic => C4::Context->preference("OpacPublic") ); @@ -1543,7 +1545,8 @@ sub check_api_auth { $session->param( 'lasttime', time() ); } elsif ( $return == 2 ) { - #We suppose the user is the superlibrarian + # It's the DB user, again! + # He won't be able to do something interesting $session->param( 'number', 0 ); $session->param( 'id', C4::Context->config('user') ); $session->param( 'cardnumber', C4::Context->config('user') ); @@ -1551,7 +1554,7 @@ sub check_api_auth { $session->param( 'surname', C4::Context->config('user') ); $session->param( 'branch', 'NO_LIBRARY_SET' ); $session->param( 'branchname', 'NO_LIBRARY_SET' ); - $session->param( 'flags', 1 ); + $session->param( 'flags', 0 ); $session->param( 'emailaddress', C4::Context->preference('KohaAdminEmailAddress') ); $session->param( 'ip', $session->remote_addr() ); $session->param( 'lasttime', time() ); @@ -1980,9 +1983,12 @@ sub haspermission { my $row = $sth->fetchrow(); my $flags = getuserflags( $row, $userid ); if ( $userid eq C4::Context->config('user') ) { - - # Super User Account from /etc/koha.conf - $flags->{'superlibrarian'} = 1; + # DB User Account from /etc/koha.conf + if ( $flagsrequired->{DB_user} == 1 ) { + $flags->{DB_user} = 1; + return $flags; + } + return 0; } elsif ( $userid eq 'demo' && C4::Context->config('demo') ) { diff --git a/about.pl b/about.pl index 4bf9779..116b587 100755 --- a/about.pl +++ b/about.pl @@ -46,7 +46,7 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user( query => $query, type => "intranet", authnotrequired => 0, - flagsrequired => { catalogue => 1 }, + flagsrequired => { catalogue => 1, DB_user => 1 }, debug => 1, } ); diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc index e71c99f..2a89950 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/header.inc @@ -5,21 +5,25 @@ [% IF ( CAN_user_circulate_circulate_remaining_permissions ) %]
  • Circulation
  • [% END %] [% IF ( CAN_user_borrowers ) %]
  • Patrons
  • [% END %] [% IF ( CAN_user_catalogue ) %]
  • Search
  • [% END %] - [% IF ( intranetbookbag ) %] + [% IF ( intranetbookbag and loggedinusernumber) %]
  • Cart
  • [% END %] [% IntranetNav %]