| Summary: | OPAC user can guess clubs of other users | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Jonathan Druart <jonathan.druart> |
| Component: | OPAC | Assignee: | Jonathan Druart <jonathan.druart> |
| Status: | Pushed to oldoldoldstable --- | QA Contact: | Martin Renvoize (ashimema) <martin.renvoize> |
| Severity: | critical | ||
| Priority: | P5 - low | CC: | dcook, didier.gautheron, f.demians, fridolin.somers, gmcharlt, jonathan.druart, kyle.m.hall, laurent.ducos, lucas, m.de.rooy, nick |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
24.05.00,23.11.03,23.05.09,22.11.15,22.05.19
|
|
| Circulation function: | |||
| Bug Depends on: | 12461 | ||
| Bug Blocks: | 35942 | ||
| Attachments: |
Bug 35941: Limit club list to those from the logged in user
Bug 35941: Limit club list to those from the logged in user Bug 35941: (QA follow-up) Tidy clubs-tab.pl Bug 35941: Limit club list to those from the logged in user Bug 35941: (QA follow-up) Tidy clubs-tab.pl |
||
|
Description
Jonathan Druart
2024-01-30 13:51:32 UTC
Created attachment 161637 [details] [review] Bug 35941: Limit club list to those from the logged in user clubs-tab get the patron's id from the parameter. At the OPAC we must use the one from the logged in user, to prevent leak to other users Test plan: Have 2 clubs: A, B Enroll to A with patron borrowernumber=1 Enroll to B with patron borrowernumber=2 Log in with patron 1 and hit: http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=1 => OK Now hit http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=2 => oops Apply this patch, try again. The "borrowernumber" parameter is no longer used to fetch the club list. Created attachment 161643 [details] [review] Bug 35941: Limit club list to those from the logged in user clubs-tab get the patron's id from the parameter. At the OPAC we must use the one from the logged in user, to prevent leak to other users Test plan: Have 2 clubs: A, B Enroll to A with patron borrowernumber=1 Enroll to B with patron borrowernumber=2 Log in with patron 1 and hit: http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=1 => OK Now hit http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=2 => oops Apply this patch, try again. The "borrowernumber" parameter is no longer used to fetch the club list. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 161644 [details] [review] Bug 35941: (QA follow-up) Tidy clubs-tab.pl Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Created attachment 161687 [details] [review] Bug 35941: Limit club list to those from the logged in user clubs-tab get the patron's id from the parameter. At the OPAC we must use the one from the logged in user, to prevent leak to other users Test plan: Have 2 clubs: A, B Enroll to A with patron borrowernumber=1 Enroll to B with patron borrowernumber=2 Log in with patron 1 and hit: http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=1 => OK Now hit http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=2 => oops Apply this patch, try again. The "borrowernumber" parameter is no longer used to fetch the club list. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Created attachment 161688 [details] [review] Bug 35941: (QA follow-up) Tidy clubs-tab.pl Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> No regressions found, QA scripts happy and resolves the issue. Passing QA Pushed to master for 24.05.00 Complex to backport to 22.11 due to patch 33895 which changed a lot of code. Is that bad if it's not backported? (In reply to Frédéric Demians from comment #8) > Complex to backport to 22.11 due to patch 33895 which changed a lot of code. > Is that bad if it's not backported? I see it in now in 22.11.15 @Lucas I don't see this in 23.05.09 (In reply to Fridolin Somers from comment #10) > @Lucas > > I don't see this in 23.05.09 Will be released in v23.05.09-1 |