Summary: | User with 'catalogue' permission can view everybody's (private) virtualshelves | ||
---|---|---|---|
Product: | Koha | Reporter: | Joonas Kylmälä <joonas.kylmala> |
Component: | Staff interface | Assignee: | Jonathan Druart <jonathan.druart> |
Status: | Pushed to oldoldoldstable --- | QA Contact: | Testopia <testopia> |
Severity: | normal | ||
Priority: | P5 - low | CC: | 1joynelson, andrewfh, dcook, fridolin.somers, gmcharlt, jonathan.druart, katrin.fischer, lucas, m.de.rooy, martin.renvoize, nick, nugged, victor, wainuiwitikapark |
Version: | master | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Trivial patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
22.05.00,21.11.02,21.05.09,20.11.14,19.11.25
|
|
Attachments: |
Bug 29542: Check permission to view list in sendshelf
Bug 29542: Prevent access to private list to non authorized users Bug 29542: Prevent access to private list to non authorized users Bug 29542: Prevent access to private list to non authorized users |
Description
Joonas Kylmälä
2021-11-20 20:01:12 UTC
Created attachment 127914 [details] [review] Bug 29542: Check permission to view list in sendshelf Test plan: Find a (private) list that you should not be able to view. Try the URL /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=[list_number] You should see an error message. (Which could surely be improved on another report.) Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Triggering more attention for this bug by changing status ;) I am not sure about the solution here, because now you still get to see the email form, the error only appears after you tried to send the list. Could we prevent showing the form and show the error right away? Created attachment 129030 [details] [review] Bug 29542: Prevent access to private list to non authorized users The catalogue permission is not enough. Test plan: Create a private list owned by user A Login with user B and hit (with XX the shelfid) /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX You should get an error message "You do not have sufficient permission to continue." Login with user A => You should be able to send the list We can early exit at the top of the script and use output_and_exit && blocking_error.inc Created attachment 129108 [details] [review] Bug 29542: Prevent access to private list to non authorized users The catalogue permission is not enough. Test plan: Create a private list owned by user A Login with user B and hit (with XX the shelfid) /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX You should get an error message "You do not have sufficient permission to continue." Login with user A => You should be able to send the list Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Created attachment 129335 [details] [review] Bug 29542: Prevent access to private list to non authorized users The catalogue permission is not enough. Test plan: Create a private list owned by user A Login with user B and hit (with XX the shelfid) /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX You should get an error message "You do not have sufficient permission to continue." Login with user A => You should be able to send the list Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Backported: Pushed to 20.11.x-security branch for 20.11.14 Pushed to security/21.05.x for 21.05.09 Backported to 19.11.x-security branch on the Security repo for 19.11.25 security release. |