Bug 24849 - Permissions checks are missing in borracount controller
Summary: Permissions checks are missing in borracount controller
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Fines and fees (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Martin Renvoize (ashimema)
QA Contact: Testopia
URL:
Keywords:
Depends on: 17473 23442 24081
Blocks: 14825
  Show dependency tree / graph
 
Reported: 2020-03-11 13:47 UTC by Martin Renvoize (ashimema)
Modified: 2020-03-11 14:01 UTC (History)
0 users

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize (ashimema) 2020-03-11 13:47:09 UTC 
Three actions are available withing the borraccount controller.. they all have sub-permissions checks to restrict the visibility of the buttons leading to those actions, but the controller itself lacks such checks and as such the permissions can be subverted.