Summary: | Reserve can be cancelled by any logged in user | ||
---|---|---|---|
Product: | Koha | Reporter: | Rafal Kopaczka <rkopaczka> |
Component: | Hold requests | Assignee: | Rafal Kopaczka <rkopaczka> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | critical | ||
Priority: | P3 | CC: | abl, fridolin.somers, gmcharlt, jonathan.druart, martin.renvoize, tomascohen |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Bug Depends on: | |||
Bug Blocks: | 12876 | ||
Attachments: |
[PATCH] Bug 12873 - Reserve can be cancelled by any logged in user It is possible to cancel reservations through simply running opac-modreserve.pl with existing reserve_id number. This may provide remove even all reservations from system. The only limitat
Bug 12873 - Reserve can be cancelled by any logged in user [PASSED QA] Bug 12873 - Reserve can be cancelled by any logged in user |
Description
Rafal Kopaczka
2014-09-04 14:40:34 UTC
Created attachment 31377 [details] [review] [PATCH] Bug 12873 - Reserve can be cancelled by any logged in user It is possible to cancel reservations through simply running opac-modreserve.pl with existing reserve_id number. This may provide remove even all reservations from system. The only limitat Test plan: 1. Create reserves by 2 different users, and get their ID's 2. Before patch, hold may by cancelled by anyone who run site: http://example.com/cgi-bin/koha/opac-modrequest.pl?reserve_id=XXX 3. After patch hold may by cancelled only by user whose reserve is. This one smells critical. Created attachment 31378 [details] [review] Bug 12873 - Reserve can be cancelled by any logged in user It is possible to cancel reservations through simply running opac-modreserve.pl with existing reserve_id number. This may provide remove even all reservations from system. The only limitation is that user have to be logged in. Simplest solution is to check whether reserve belongs to user or not. Test plan: 1. Create reserves by 2 different users, and get their ID's 2. Before patch, hold may by cancelled by anyone who run site: http://example.com/cgi-bin/koha/opac-modrequest.pl?reserve_id=XXX 3. After patch hold may by cancelled only by user whose reserve is. Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> In doubt, I put this bug report in Koha security. I am under the impression that this bug should not be public and fix asap for all branches. Created attachment 31379 [details] [review] [PASSED QA] Bug 12873 - Reserve can be cancelled by any logged in user It is possible to cancel reservations through simply running opac-modreserve.pl with existing reserve_id number. This may provide remove even all reservations from system. The only limitation is that user have to be logged in. Simplest solution is to check whether reserve belongs to user or not. Test plan: 1. Create reserves by 2 different users, and get their ID's 2. Before patch, hold may by cancelled by anyone who run site: http://example.com/cgi-bin/koha/opac-modrequest.pl?reserve_id=XXX 3. After patch hold may by cancelled only by user whose reserve is. Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Well caught.. makes me wonder if there are any similar issues lurking around. Ouch, there's one more thing I forgot. Reserve may still be cancelled by owner even if it shouldn't be able to, when hold is in waiting status. Not so critical as previous but still. Add this as new bug or attach to this patch? That will be additional conditions only: ($res->{wait} and not $res->{found}) or (not $res->{wait} and not $res->{inrtansit}) #taken from opac-user.pl (In reply to Rafal Kopaczka from comment #7) > Ouch, there's one more thing I forgot. Reserve may still be cancelled by > owner even if it shouldn't be able to, when hold is in waiting status. Not > so critical as previous but still. Add this as new bug or attach to this > patch? Yes, please open a new bug report. (In reply to Martin Renvoize from comment #6) > Well caught.. makes me wonder if there are any similar issues lurking around. Same situation is in opac-modrequest-suspend.pl with ToggleSuspend function. In bug 12876 is improved version of patch with more cases taken into account. Can someone take look at this? I've added function to check if reserve may be cancelled, this function should be also called in opac-user.pl, but there's big mess if it comes to reserve handling. Patch pushed to master. Thanks Rafal! Pushed to 3.16.x for inclusion in 3.16.4. Pushed to 3.14.x, will be in 3.14.11 |