View | Details | Raw Unified | Return to bug 14686
Collapse All | Expand All

(-)a/Koha/Schema/Result/UploadedFile.pm (-1 / +15 lines)
Lines 124-128 __PACKAGE__->set_primary_key("id"); Link Here
124
# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:Cq/HSuTaBxZH2qSGEddoaQ
124
# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:Cq/HSuTaBxZH2qSGEddoaQ
125
125
126
126
127
# You can replace this text with custom code or comments, and it will be preserved on regeneration
127
sub allows_add_by {
128
    my ( $self, $userid ) = @_; # do not confuse with borrowernumber
129
    my $flags = [
130
        { tools      => 'upload_general_files' },
131
        { circulate  => 'circulate_remaining_permissions' },
132
        { tools      => 'stage_marc_import' },
133
        { tools      => 'upload_local_cover_images' },
134
    ];
135
    require C4::Auth;
136
    foreach( @$flags ) {
137
        return 1 if C4::Auth::haspermission( $userid, $_ );
138
    }
139
    return;
140
}
141
128
1;
142
1;
(-)a/t/db_dependent/Upload.t (-4 / +48 lines)
Lines 2-18 Link Here
2
2
3
use Modern::Perl;
3
use Modern::Perl;
4
use File::Temp qw/ tempdir /;
4
use File::Temp qw/ tempdir /;
5
use Test::More tests => 7;
5
use Test::More tests => 8;
6
6
7
use Test::MockModule;
7
use Test::MockModule;
8
use t::lib::Mocks;
8
use t::lib::Mocks;
9
use t::lib::TestBuilder;
9
10
10
use C4::Context;
11
use C4::Context;
12
use Koha::Database;
11
use Koha::Upload;
13
use Koha::Upload;
14
use Koha::Schema::Result::UploadedFile;
12
15
16
my $schema  = Koha::Database->new->schema;
17
$schema->storage->txn_begin;
13
my $dbh = C4::Context->dbh;
18
my $dbh = C4::Context->dbh;
14
$dbh->{AutoCommit} = 0;
15
$dbh->{RaiseError} = 1;
16
19
17
our $current_upload = 0;
20
our $current_upload = 0;
18
our $uploads = [
21
our $uploads = [
Lines 81-87 subtest 'Test07' => sub { Link Here
81
    plan tests => 2;
84
    plan tests => 2;
82
    test07();
85
    test07();
83
};
86
};
84
$dbh->rollback;
87
subtest 'Test08: UploadedFile->allows_add_by' => sub {
88
    plan tests => 4;
89
    test08();
90
};
91
$schema->storage->txn_rollback;
85
92
86
sub test01 {
93
sub test01 {
87
    # Delete existing records (for later tests)
94
    # Delete existing records (for later tests)
Lines 169-174 sub test07 { #simple test for httpheaders and getCategories Link Here
169
    is( @$cat >= 1, 1, 'getCategories returned at least one category' );
176
    is( @$cat >= 1, 1, 'getCategories returned at least one category' );
170
}
177
}
171
178
179
sub test08 { # UploadedFile->allows_add_by
180
    my $builder = t::lib::TestBuilder->new;
181
    my $patron = $builder->build({
182
        source => 'Borrower',
183
        value  => { flags => 0 }, #no permissions
184
    });
185
    my $patronid = $patron->{borrowernumber};
186
    is( Koha::Schema::Result::UploadedFile->allows_add_by( $patron->{userid} ),
187
        undef, 'Patron is not allowed to do anything' );
188
189
    # add some permissions: edit_catalogue
190
    my $fl = 2**9; # edit_catalogue
191
    $schema->resultset('Borrower')->find( $patronid )->update({ flags => $fl });
192
    is( Koha::Schema::Result::UploadedFile->allows_add_by( $patron->{userid} ),
193
        undef, 'Patron is still not allowed to add uploaded files' );
194
195
    # replace flags by all tools
196
    $fl = 2**13; # tools
197
    $schema->resultset('Borrower')->find( $patronid )->update({ flags => $fl });
198
    is( Koha::Schema::Result::UploadedFile->allows_add_by( $patron->{userid} ),
199
        1, 'Patron should be allowed now to add uploaded files' );
200
201
    # remove all tools and add upload_general_files only
202
    $fl = 0; # no modules
203
    $schema->resultset('Borrower')->find( $patronid )->update({ flags => $fl });
204
    $builder->build({
205
        source => 'UserPermission',
206
        value  => {
207
            borrowernumber => $patronid,
208
            module_bit     => { module_bit => { flag => 'tools' } },
209
            code           => 'upload_general_files',
210
        },
211
    });
212
    is( Koha::Schema::Result::UploadedFile->allows_add_by( $patron->{userid} ),
213
        1, 'Patron is still allowed to add uploaded files' );
214
}
215
172
sub newCGI {
216
sub newCGI {
173
    my ( $class, $hook ) = @_;
217
    my ( $class, $hook ) = @_;
174
    my $read = 0;
218
    my $read = 0;
(-)a/tools/upload-file.pl (-15 / +3 lines)
Lines 28-33 use URI::Escape; Link Here
28
use C4::Context;
28
use C4::Context;
29
use C4::Auth qw/check_cookie_auth haspermission/;
29
use C4::Auth qw/check_cookie_auth haspermission/;
30
use Koha::Upload;
30
use Koha::Upload;
31
use Koha::Schema::Result::UploadedFile;
31
32
32
# upload-file.pl must authenticate the user
33
# upload-file.pl must authenticate the user
33
# before processing the POST request,
34
# before processing the POST request,
Lines 37-61 use Koha::Upload; Link Here
37
# requires that the session cookie already
38
# requires that the session cookie already
38
# has been created.
39
# has been created.
39
40
40
my $flags_required = [
41
    {circulate  => 'circulate_remaining_permissions'},
42
    {tools      => 'stage_marc_import'},
43
    {tools      => 'upload_local_cover_images'}
44
];
45
46
my %cookies = CGI::Cookie->fetch;
41
my %cookies = CGI::Cookie->fetch;
47
my $sid = $cookies{'CGISESSID'}->value;
42
my $sid = $cookies{'CGISESSID'}->value;
48
49
my $auth_failure = 1;
50
my ( $auth_status, $sessionID ) = check_cookie_auth( $sid );
43
my ( $auth_status, $sessionID ) = check_cookie_auth( $sid );
51
my $uid = C4::Auth::get_session($sid)->param('id');
44
my $uid = C4::Auth::get_session($sid)->param('id');
52
foreach my $flag_required ( @{$flags_required} ) {
45
my $allowed = Koha::Schema::Result::UploadedFile->allows_add_by( $uid );
53
    if ( my $flags = haspermission( $uid, $flag_required ) ) {
54
        $auth_failure = 0 if $auth_status eq 'ok';
55
    }
56
}
57
46
58
if ($auth_failure) {
47
if( $auth_status ne 'ok' || !$allowed ) {
59
    send_reply( 'denied' );
48
    send_reply( 'denied' );
60
    exit 0;
49
    exit 0;
61
}
50
}
62
- 

Return to bug 14686