Summary: | patronimage.pl permission is too restrictive | ||
---|---|---|---|
Product: | Koha | Reporter: | Fridolin Somers <fridolin.somers> |
Component: | Patrons | Assignee: | Bugs List <koha-bugs> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | minor | ||
Priority: | P5 - low | CC: | brendan, f.demians, gmcharlt, julian.maurice, kyle.m.hall, sandboxes, sophie.meynieux |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Bug Depends on: | 14566 | ||
Bug Blocks: | 29541 | ||
Attachments: |
Bug 17423 - patronimage.pl permission is too restrictive
Bug 17423 - patronimage.pl permission is too restrictive Bug 17423 - patronimage.pl permission is too restrictive Bug 17423 - patronimage.pl permission is too restrictive Bug 17423 - patronimage.pl permission is too restrictive |
Description
Fridolin Somers
2016-10-11 07:59:05 UTC
Created attachment 56134 [details] [review] Bug 17423 - patronimage.pl permission is too restrictive Bug 14566 added the permission "borrowers" on patronimage.pl. This perm is too restrictive because circulation pages also uses this page. I propose to simply use "catalogue" perm. Test plan - Set an image to borrower xx - Create a user with only catalogue permission - Log with this user - Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx => Without patch you get 403 error => With patch you get the image *** Bug 17325 has been marked as a duplicate of this bug. *** Created attachment 56136 [details] [review] Bug 17423 - patronimage.pl permission is too restrictive Bug 14566 added the permission "borrowers" on patronimage.pl. This perm is too restrictive because circulation pages also uses this page. I propose to simply use "catalogue" perm. Test plan - Set an image to borrower xx - Create a user with only catalogue permission - Log with this user - Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx => Without patch you get 403 error => With patch you get the image - Log out and test the page patronimage.pl => You get 403 error Created attachment 56150 [details] [review] Bug 17423 - patronimage.pl permission is too restrictive Bug 14566 added the permission "borrowers" on patronimage.pl. This perm is too restrictive because circulation pages also uses this page. I propose to simply use "catalogue" perm. Test plan - Set an image to borrower xx - Create a user with only catalogue permission - Log with this user - Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx => Without patch you get the page saying you do not have the permission => With patch you get the image - Log out and retest the page patronimage.pl => You get 403 error Patch tested with a sandbox, by remy <remy.gonzalves@iepg.fr> Created attachment 56166 [details] [review] Bug 17423 - patronimage.pl permission is too restrictive Bug 14566 added the permission "borrowers" on patronimage.pl. This perm is too restrictive because circulation pages also uses this page. I propose to simply use "catalogue" perm. Test plan - Set an image to borrower xx - Create a user with only catalogue permission - Log with this user - Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx => Without patch you get the page saying you do not have the permission => With patch you get the image - Log out and retest the page patronimage.pl => You get 403 error Signed-off-by: remy <remy.gonzalves@iepg.fr> Created attachment 56289 [details] [review] Bug 17423 - patronimage.pl permission is too restrictive Bug 14566 added the permission "borrowers" on patronimage.pl. This perm is too restrictive because circulation pages also uses this page. I propose to simply use "catalogue" perm. Test plan - Set an image to borrower xx - Create a user with only catalogue permission - Log with this user - Go to page (replace xx by borrower number) : /cgi-bin/koha/members/patronimage.pl?borrowernumber=xx => Without patch you get the page saying you do not have the permission => With patch you get the image - Log out and retest the page patronimage.pl => You get 403 error Signed-off-by: remy <remy.gonzalves@iepg.fr> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Pushed to Master - Should be in the November 16.11 Release. Thanks! Pushed in 16.05. Will be in 16.05.05. Pushed in 3.22.x, will be in 3.22.12 |