Bug 24849 - Permissions checks are missing in borracount controller
Summary: Permissions checks are missing in borracount controller
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Fines and fees (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Martin Renvoize
QA Contact: Testopia
URL:
Keywords:
Depends on: 17473 24081 23442
Blocks: 14825
  Show dependency treegraph
 
Reported: 2020-03-11 13:47 UTC by Martin Renvoize
Modified: 2020-03-11 14:01 UTC (History)
0 users

See Also:
Change sponsored?: ---
Patch complexity: ---
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize 2020-03-11 13:47:09 UTC
Three actions are available withing the borraccount controller.. they all have sub-permissions checks to restrict the visibility of the buttons leading to those actions, but the controller itself lacks such checks and as such the permissions can be subverted.