From 7ea9ca31fb3688befa67fd1a5ae51b6defd9294d Mon Sep 17 00:00:00 2001 From: David Cook Date: Thu, 27 Jul 2017 11:58:28 +1000 Subject: [PATCH] Bug 18898 - Some permissions for Reports can be bypassed If you manually visit the following links when you only have permission to run reports, you'll still be able to access the ability to create and edit reports: /cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL /cgi-bin/koha/reports/guided_reports.pl?phase=Edit%20SQL This patch ties these 2 unaccounted for phases to the create_reports permission. --- reports/guided_reports.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reports/guided_reports.pl b/reports/guided_reports.pl index b81e84f321..bfd0a7646b 100755 --- a/reports/guided_reports.pl +++ b/reports/guided_reports.pl @@ -53,7 +53,7 @@ my $usecache = Koha::Caches->get_instance->memcached_cache; my $phase = $input->param('phase') // ''; my $flagsrequired; -if ( $phase eq 'Build new' ) { +if ( ( $phase eq 'Build new' ) || ( $phase eq 'Create report from SQL' ) || ( $phase eq 'Edit SQL' ) ){ $flagsrequired = 'create_reports'; } elsif ( $phase eq 'Use saved' ) { -- 2.12.0