Bug 14440 - get_template_and_user can not have an empty template_name
Summary: get_template_and_user can not have an empty template_name
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff Client (show other bugs)
Version: master
Hardware: All All
: P5 - low major (vote)
Assignee: Fridolin SOMERS
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
: 14563 (view as bug list)
Depends on: 14408
Blocks:
  Show dependency treegraph
 
Reported: 2015-06-23 14:06 UTC by Fridolin SOMERS
Modified: 2016-12-05 21:23 UTC (History)
9 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 14440 - get_template_and_user can not have an empty template_name (updatesupplier.pl) (1.69 KB, patch)
2015-06-23 15:17 UTC, Fridolin SOMERS
Details | Diff | Splinter Review
bug 14440 - work around for empty tt filenames (2.45 KB, patch)
2015-06-23 23:23 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 14440 - get_template_and_user can not have an empty template_name (opac-ratings.pl) (3.11 KB, patch)
2015-06-24 07:24 UTC, Fridolin SOMERS
Details | Diff | Splinter Review
Bug 14440: get_template_and_user can not have an empty template_name (quote*_ajax.pl) (2.67 KB, patch)
2015-06-24 09:06 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 14440 - get_template_and_user can not have an empty template_name (updatesupplier.pl) (1.77 KB, patch)
2015-06-24 17:31 UTC, Indranil Das Gupta
Details | Diff | Splinter Review
Bug 14440 - get_template_and_user can not have an empty template_name (opac-ratings.pl) (3.18 KB, patch)
2015-06-24 19:51 UTC, Indranil Das Gupta
Details | Diff | Splinter Review
Bug 14440: get_template_and_user can not have an empty template_name (quote*_ajax.pl) (2.74 KB, patch)
2015-06-24 19:53 UTC, Indranil Das Gupta
Details | Diff | Splinter Review
(qa fix) sysprefs order and TT plugin access (3.24 KB, patch)
2015-06-24 20:15 UTC, Indranil Das Gupta
Details | Diff | Splinter Review
[SIGNED OFF] Bug 14440: get_template_and_user can not have an empty template_name (updatesupplier.pl) (1.83 KB, patch)
2015-06-24 21:27 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
[SIGNED OFF] Bug 14440: get_template_and_user can not have an empty template_name (opac-ratings.pl) (3.40 KB, patch)
2015-06-24 21:28 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
[SIGNED OFF] Bug 14440: get_template_and_user can not have an empty template_name (quote*_ajax.pl) (2.88 KB, patch)
2015-06-24 21:28 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
[PASSED QA] Bug 14440: get_template_and_user can not have an empty template_name (updatesupplier.pl) (1.83 KB, patch)
2015-06-25 09:03 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA]  Bug 14440: get_template_and_user can not have an empty template_name (opac-ratings.pl) (3.47 KB, patch)
2015-06-25 09:03 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA]  Bug 14440: get_template_and_user can not have an empty template_name (quote*_ajax.pl) (2.94 KB, patch)
2015-06-25 09:03 UTC, Katrin Fischer
Details | Diff | Splinter Review
[3.18.x] Bug 14440: get_template_and_user can not have an empty template_name (opac-ratings.pl) (3.38 KB, patch)
2015-06-26 08:00 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Fridolin SOMERS 2015-06-23 14:06:11 UTC
Since Bug 14408, the method get_template_and_user can not have an empty template_name.
Pages calling with an empty value should useC4::Auth::haspermission.
Comment 1 Fridolin SOMERS 2015-06-23 14:09:48 UTC
Concerned pages :

acqui/updatesupplier.pl
opac/opac-ratings.pl
tools/quotes/quotes_ajax.pl
tools/quotes/quotes-upload_ajax.pl
Comment 2 Fridolin SOMERS 2015-06-23 14:29:19 UTC
In fact, pages should use C4::Auth::checkauth()
Comment 3 Fridolin SOMERS 2015-06-23 15:17:09 UTC Comment hidden (obsolete)
Comment 4 Chris Cormack 2015-06-23 23:03:28 UTC
A work around is to do

- template_name   => ""
+ template_name   => "/errors/404.tt"

(any template that exists will do, it is never printed, we just redirect)
Comment 5 Liz Rea 2015-06-23 23:23:49 UTC Comment hidden (obsolete)
Comment 6 Fridolin SOMERS 2015-06-24 07:24:05 UTC Comment hidden (obsolete)
Comment 7 Fridolin SOMERS 2015-06-24 07:25:05 UTC
(In reply to Liz Rea from comment #5)
> Created attachment 40544 [details] [review] [review]
> bug 14440 - work around for empty tt filenames
> 
> This is a work around for the bug of not accepting empty template names.
> 
> To test:
> 
> Make sure all of these functions still work.

Thanks Liz, maybe we could use this patch to fix quickly on stable branches
Comment 8 Jonathan Druart 2015-06-24 09:06:23 UTC Comment hidden (obsolete)
Comment 9 Fridolin SOMERS 2015-06-24 13:37:13 UTC
Thanks Jonathan, I'm not very familiar with Ajax.
( except when cleaning the house :D )
Comment 10 Indranil Das Gupta 2015-06-24 17:31:37 UTC Comment hidden (obsolete)
Comment 11 Indranil Das Gupta 2015-06-24 19:51:01 UTC Comment hidden (obsolete)
Comment 12 Indranil Das Gupta 2015-06-24 19:53:53 UTC Comment hidden (obsolete)
Comment 13 Indranil Das Gupta 2015-06-24 20:15:50 UTC Comment hidden (obsolete)
Comment 14 Tomás Cohen Arazi 2015-06-24 21:27:56 UTC Comment hidden (obsolete)
Comment 15 Tomás Cohen Arazi 2015-06-24 21:28:05 UTC Comment hidden (obsolete)
Comment 16 Tomás Cohen Arazi 2015-06-24 21:28:14 UTC Comment hidden (obsolete)
Comment 17 Katrin Fischer 2015-06-25 09:03:42 UTC
Created attachment 40620 [details] [review]
[PASSED QA] Bug 14440: get_template_and_user can not have an empty template_name (updatesupplier.pl)

Since Bug 14408, the method get_template_and_user can not have an empty template_name.
Pages calling with an empty value should use C4::Auth::checkauth()

This patch corrects acqui/updatesupplier.pl

Test plan :
- Apply patch
- Connect to intranet with a user having "vendors_manage" permission
- Go to acquisition module
- Create a new vendor
- Click on "Edit vendor"
- Change some information and save
=> Your change is saved
- Connect to intranet with a user not having "vendors_manage" permission
- Try to access <intranet>/cgi-bin/koha/acqui/updatesupplier.pl
=> Access is denied
- Disconnect from intranet
- Try to access <intranet>/cgi-bin/koha/acqui/updatesupplier.pl
=> Access is denied

Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 18 Katrin Fischer 2015-06-25 09:03:45 UTC
Created attachment 40621 [details] [review]
[PASSED QA]  Bug 14440: get_template_and_user can not have an empty template_name (opac-ratings.pl)

Since Bug 14408, the method get_template_and_user can not have an empty template_name.
Pages calling with an empty value should use C4::Auth::checkauth()

This patch corrects opac/opac-ratings.pl

Test plan :
- Apply patch
- Set sysopref OpacStarRatings to 'results and details'
- Disable Javascipt on your browser (otherwise it will use ajax)
- Login at OPAC
- Go to a record
- Click on a button left of 'Rate me' to choose a rating, ie 4
- Click on 'Rate me'
=> The page is reloaded and you see 'your rating: 4'
- Loggout from OPAC
- Try to access URL : http://<serveur>/cgi-bin/koha/opac-ratings.pl
=> You see the loggin page

Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Comment 19 Katrin Fischer 2015-06-25 09:03:48 UTC
Created attachment 40622 [details] [review]
[PASSED QA]  Bug 14440: get_template_and_user can not have an empty template_name (quote*_ajax.pl)

This patch uses check_api_auth instead of get_template_and_user.

Test plan:
Confirm that you are still able to access to the quote editor with the
edit_quotes permission.
Confirm that you are not if you don't have the permission.

wget your_url/cgi-bin/koha/tools/quotes/quotes_ajax.pl
should return "403 : Forbidden."

Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Comment 20 Katrin Fischer 2015-06-25 12:14:37 UTC
Hm, I have problems applying those patches on 3.18.x, we might need a slightly different/rebased version there.
Comment 21 Tomás Cohen Arazi 2015-06-25 17:52:47 UTC
Patches pushed to master.

Thanks Frido and Jonathan!
Comment 22 Chris Cormack 2015-06-25 21:09:06 UTC
Pushed to 3.20.x will be in 3.20.2
Comment 23 Katrin Fischer 2015-06-26 07:38:23 UTC
The patch for the ratings needs to be amended to work correctly on 3.18 - resolving the conflict and removing all the 'use' as in the patch will break the feature it looks like.
Comment 24 Katrin Fischer 2015-06-26 08:00:25 UTC
Created attachment 40648 [details] [review]
[3.18.x] Bug 14440: get_template_and_user can not have an empty template_name (opac-ratings.pl)

Since Bug 14408, the method get_template_and_user can not have an empty template_name.
Pages calling with an empty value should use C4::Auth::checkauth()

This patch corrects opac/opac-ratings.pl

Test plan :
- Apply patch
- Set sysopref OpacStarRatings to 'results and details'
- Disable Javascipt on your browser (otherwise it will use ajax)
- Login at OPAC
- Go to a record
- Click on a button left of 'Rate me' to choose a rating, ie 4
- Click on 'Rate me'
=> The page is reloaded and you see 'your rating: 4'
- Loggout from OPAC
- Try to access URL : http://<serveur>/cgi-bin/koha/opac-ratings.pl
=> You see the loggin page

Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>

Conflicts:
	opac/opac-ratings.pl
Comment 25 Katrin Fischer 2015-06-26 08:01:44 UTC
I think the last patch I attached should work for 3.18.x. But please double check before this is used!
Comment 26 Katrin Fischer 2015-07-18 18:36:39 UTC
*** Bug 14563 has been marked as a duplicate of this bug. ***
Comment 27 Liz Rea 2015-07-20 22:01:18 UTC
Pushed to 3.18.x, will be in 3.18.09

Used the 3.18.x patch for opac-ratings, thanks Katrin.
Comment 28 Mason James 2015-07-25 10:33:56 UTC
Pushed to 3.16.x, will be in 3.16.13