Summary: | Canceling an article request should verify the request belongs to the borrower | ||
---|---|---|---|
Product: | Koha | Reporter: | Ere Maijala <ere.maijala> |
Component: | Circulation | Assignee: | Jonathan Druart <jonathan.druart> |
Status: | CLOSED FIXED | QA Contact: | Tomás Cohen Arazi (tcohen) <tomascohen> |
Severity: | critical | ||
Priority: | P5 - low | CC: | fridolin.somers, gmcharlt, jonathan.druart, kyle.m.hall, lucas, martin.renvoize, nick, tomascohen |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: |
19.05.00, 18.11.05, 17.11.18
|
Circulation function: | |
Bug Depends on: | 14610 | ||
Bug Blocks: | |||
Attachments: |
Bug 22068: Prevent patrons to cancel article request they did not create
Bug 22068: Prevent patrons to cancel article request they did not create Bug 22068: Prevent patrons to cancel article request they did not create Bug 22068: (QA follow-up) Return meaningful error codes |
Description
Ere Maijala
2019-01-04 05:47:17 UTC
Created attachment 85137 [details] [review] Bug 22068: Prevent patrons to cancel article request they did not create opac-article-request-cancel.pl doesn't check that the article request to be cancelled actually belongs to the logged-in borrower. This results in any logged-in user being able to cancel any article request just by changing the id in the URL. Test plan: - Login with Patron P1, create an article request - Cancel it - Create another one - Copy the cancellation link (must be /cgi-bin/koha/opac-article-request-cancel.pl?id=X) - Login with Patron P2 - Hit the cancellation link => Without this patch the article request is cancelled => With this patch applied there is a 404 redirection Note that the 404 will also appears when the article request id does not exist. Created attachment 87438 [details] [review] Bug 22068: Prevent patrons to cancel article request they did not create opac-article-request-cancel.pl doesn't check that the article request to be cancelled actually belongs to the logged-in borrower. This results in any logged-in user being able to cancel any article request just by changing the id in the URL. Test plan: - Login with Patron P1, create an article request - Cancel it - Create another one - Copy the cancellation link (must be /cgi-bin/koha/opac-article-request-cancel.pl?id=X) - Login with Patron P2 - Hit the cancellation link => Without this patch the article request is cancelled => With this patch applied there is a 404 redirection Note that the 404 will also appears when the article request id does not exist. Signed-off-by: Ere Maijala <ere.maijala@helsinki.fi> Created attachment 87460 [details] [review] Bug 22068: Prevent patrons to cancel article request they did not create opac-article-request-cancel.pl doesn't check that the article request to be cancelled actually belongs to the logged-in borrower. This results in any logged-in user being able to cancel any article request just by changing the id in the URL. Test plan: - Login with Patron P1, create an article request - Cancel it - Create another one - Copy the cancellation link (must be /cgi-bin/koha/opac-article-request-cancel.pl?id=X) - Login with Patron P2 - Hit the cancellation link => Without this patch the article request is cancelled => With this patch applied there is a 404 redirection Note that the 404 will also appears when the article request id does not exist. Signed-off-by: Ere Maijala <ere.maijala@helsinki.fi> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Created attachment 87461 [details] [review] Bug 22068: (QA follow-up) Return meaningful error codes Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Awesome work all! Pushed to master for 19.05 Pushed to 18.11.x for 18.11.05 backported to 18.05.x for 18.05.12 Pushed to 17.11.x for 17.11.18 |