Bug 24849

Summary: Permissions checks are missing in borracount controller
Product: Koha Reporter: Martin Renvoize (ashimema) <martin.renvoize>
Component: Fines and feesAssignee: Martin Renvoize (ashimema) <martin.renvoize>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low    
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on: 17473, 23442, 24081    
Bug Blocks: 14825    

Description Martin Renvoize (ashimema) 2020-03-11 13:47:09 UTC
Three actions are available withing the borraccount controller.. they all have sub-permissions checks to restrict the visibility of the buttons leading to those actions, but the controller itself lacks such checks and as such the permissions can be subverted.