Summary: | ManaKB Permissions can be subverted | ||
---|---|---|---|
Product: | Koha | Reporter: | Martin Renvoize (ashimema) <martin.renvoize> |
Component: | Mana-kb | Assignee: | Bugs List <koha-bugs> |
Status: | NEW --- | QA Contact: | |
Severity: | normal | ||
Priority: | P5 - low | CC: | jonathan.druart |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: |
Description
Martin Renvoize (ashimema)
2019-10-22 12:50:55 UTC
Can you detail? I do not get it. Test plan 1) Add a new user with 'manage_sysprefs' permission. 2) Note that this user can change Mana related sytem preferences via `Home › Administration › System preferences > Web services > Mana KB` regardless of whether that also have the `manage_mana` permission or not. Note: This is actually the same case for HEA prefs too. Do we really need this specific permission? I would go for removing manage_mana and use manage_sysprefs instead. Or, if we really need it, add a warning in the pref's description. |