| Summary: | Permissions for circ/ysearch.pl override specific page level permissions and delete sessions improperly | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Nick Clemens (kidclamp) <nick> |
| Component: | Hold requests | Assignee: | Nick Clemens (kidclamp) <nick> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | gmcharlt, jonathan.druart, kyle, martin.renvoize |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Attachments: |
Bug 20707: Replace circ/search.pl circulate permission requirement with catalogue
Bug 20707: Replace circ/search.pl circulate permission requirement with catalogue Bug 20707: Replace circ/search.pl circulate permission requirement with catalogue |
||
|
Description
Nick Clemens (kidclamp)
2018-05-03 20:08:54 UTC
With Kyle's help we tracked this down: when placing a hold if you trigger the autocomplete i.e. ysearch.pl you are logged out as not having permissions circ/ysearch requires circulate => '*' whereas request.pl requires reserveforothers => 'place_holds' this is also true for course reserves - searching for an instructor will log the user out unless they have circulate permissions. tags-review uses it as well I think the most straightforward route is to remove the circulate permission check from ysearch and require simply catalogue. Created attachment 75078 [details] [review] Bug 20707: Replace circ/search.pl circulate permission requirement with catalogue To test: 1 - Setup a staff patron with permissions: catalogue reserveforothers course_reserves 2 - Log in to staff client as that patron 3 - Find a record and click to place a hold 4 - Type more than three letters into the search bar but don't submit 5 - Note that you will not receive autocomplete results 6 - Either submit, or try to visit any page in staff client 7 - Your session has been expired, you must log in again 8 - Log in, go to course reserves 9 - As before, trigger the autocomplete search in the instrcutor field 10 - Again your session has been terminated 11 - Apply patch 12 - Repeat above actions, this time you will not be kicked out Note: Workaround is to disable CircAutoCompl So it's not critical finally? Created attachment 75220 [details] [review] Bug 20707: Replace circ/search.pl circulate permission requirement with catalogue To test: 1 - Setup a staff patron with permissions: - catalogue - reserveforothers - course_reserves 2 - Log in to staff client as that patron 3 - Find a record and click to place a hold 4 - Type more than three letters into the search bar but don't submit 5 - Note that you will not receive autocomplete results 6 - Either submit, or try to visit any page in staff client 7 - Your session has been expired, you must log in again 8 - Log in, go to course reserves 9 - As before, trigger the autocomplete search in the instrcutor field 10 - Again your session has been terminated 11 - Apply patch 12 - Repeat above actions, this time you will not be kicked out Signed-off-by: Owen Leonard <oleonard@myacpl.org> Created attachment 75242 [details] [review] Bug 20707: Replace circ/search.pl circulate permission requirement with catalogue To test: 1 - Setup a staff patron with permissions: - catalogue - reserveforothers - course_reserves 2 - Log in to staff client as that patron 3 - Find a record and click to place a hold 4 - Type more than three letters into the search bar but don't submit 5 - Note that you will not receive autocomplete results 6 - Either submit, or try to visit any page in staff client 7 - Your session has been expired, you must log in again 8 - Log in, go to course reserves 9 - As before, trigger the autocomplete search in the instrcutor field 10 - Again your session has been terminated 11 - Apply patch 12 - Repeat above actions, this time you will not be kicked out Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Pushed to master for 18.05, thanks to everybody involved! |