Bug 22068

Summary: Canceling an article request should verify the request belongs to the borrower
Product: Koha Reporter: Ere Maijala <ere.maijala>
Component: CirculationAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Tomás Cohen Arazi (tcohen) <tomascohen>
Severity: critical    
Priority: P5 - low CC: fridolin.somers, gmcharlt, jonathan.druart, kyle.m.hall, lucas, martin.renvoize, nick, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
19.05.00, 18.11.05, 17.11.18
Circulation function:
Bug Depends on: 14610    
Bug Blocks:    
Attachments: Bug 22068: Prevent patrons to cancel article request they did not create
Bug 22068: Prevent patrons to cancel article request they did not create
Bug 22068: Prevent patrons to cancel article request they did not create
Bug 22068: (QA follow-up) Return meaningful error codes

Description Ere Maijala 2019-01-04 05:47:17 UTC
It seems that opac-article-request-cancel.pl doesn't check that the article request to be cancelled actually belongs to the logged-in borrower. This results in any logged-in user being able to cancel any article request just by changing the id in the URL.
Comment 1 Jonathan Druart 2019-02-14 20:07:11 UTC
Created attachment 85137 [details] [review]
Bug 22068: Prevent patrons to cancel article request they did not create

opac-article-request-cancel.pl doesn't check that the article request to
be cancelled actually belongs to the logged-in borrower. This results in
any logged-in user being able to cancel any article request just by
changing the id in the URL.

Test plan:
- Login with Patron P1, create an article request
- Cancel it
- Create another one
- Copy the cancellation link (must be /cgi-bin/koha/opac-article-request-cancel.pl?id=X)
- Login with Patron P2
- Hit the cancellation link
=> Without this patch the article request is cancelled
=> With this patch applied there is a 404 redirection

Note that the 404 will also appears when the article request id does not
exist.
Comment 2 Ere Maijala 2019-04-05 07:54:17 UTC
Created attachment 87438 [details] [review]
Bug 22068: Prevent patrons to cancel article request they did not create

opac-article-request-cancel.pl doesn't check that the article request to
be cancelled actually belongs to the logged-in borrower. This results in
any logged-in user being able to cancel any article request just by
changing the id in the URL.

Test plan:
- Login with Patron P1, create an article request
- Cancel it
- Create another one
- Copy the cancellation link (must be /cgi-bin/koha/opac-article-request-cancel.pl?id=X)
- Login with Patron P2
- Hit the cancellation link
=> Without this patch the article request is cancelled
=> With this patch applied there is a 404 redirection

Note that the 404 will also appears when the article request id does not
exist.

Signed-off-by: Ere Maijala <ere.maijala@helsinki.fi>
Comment 3 Tomás Cohen Arazi (tcohen) 2019-04-05 18:21:12 UTC
Created attachment 87460 [details] [review]
Bug 22068: Prevent patrons to cancel article request they did not create

opac-article-request-cancel.pl doesn't check that the article request to
be cancelled actually belongs to the logged-in borrower. This results in
any logged-in user being able to cancel any article request just by
changing the id in the URL.

Test plan:
- Login with Patron P1, create an article request
- Cancel it
- Create another one
- Copy the cancellation link (must be /cgi-bin/koha/opac-article-request-cancel.pl?id=X)
- Login with Patron P2
- Hit the cancellation link
=> Without this patch the article request is cancelled
=> With this patch applied there is a 404 redirection

Note that the 404 will also appears when the article request id does not
exist.

Signed-off-by: Ere Maijala <ere.maijala@helsinki.fi>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 4 Tomás Cohen Arazi (tcohen) 2019-04-05 18:21:15 UTC
Created attachment 87461 [details] [review]
Bug 22068: (QA follow-up) Return meaningful error codes

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 5 Nick Clemens (kidclamp) 2019-04-10 20:12:54 UTC
Awesome work all!

Pushed to master for 19.05
Comment 6 Martin Renvoize (ashimema) 2019-04-15 10:58:16 UTC
Pushed to 18.11.x for 18.11.05
Comment 7 Lucas Gass (lukeg) 2019-04-15 18:10:56 UTC
backported to 18.05.x for 18.05.12
Comment 8 Fridolin Somers 2019-04-30 08:08:43 UTC
Pushed to 17.11.x for 17.11.18