Created attachment 161637 [details] [review] Bug 35941: Limit club list to those from the logged in user clubs-tab get the patron's id from the parameter. At the OPAC we must use the one from the logged in user, to prevent leak to other users Test plan: Have 2 clubs: A, B Enroll to A with patron borrowernumber=1 Enroll to B with patron borrowernumber=2 Log in with patron 1 and hit: http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=1 => OK Now hit http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=2 => oops Apply this patch, try again. The "borrowernumber" parameter is no longer used to fetch the club list.
Created attachment 161643 [details] [review] Bug 35941: Limit club list to those from the logged in user clubs-tab get the patron's id from the parameter. At the OPAC we must use the one from the logged in user, to prevent leak to other users Test plan: Have 2 clubs: A, B Enroll to A with patron borrowernumber=1 Enroll to B with patron borrowernumber=2 Log in with patron 1 and hit: http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=1 => OK Now hit http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=2 => oops Apply this patch, try again. The "borrowernumber" parameter is no longer used to fetch the club list. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Created attachment 161644 [details] [review] Bug 35941: (QA follow-up) Tidy clubs-tab.pl Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Created attachment 161687 [details] [review] Bug 35941: Limit club list to those from the logged in user clubs-tab get the patron's id from the parameter. At the OPAC we must use the one from the logged in user, to prevent leak to other users Test plan: Have 2 clubs: A, B Enroll to A with patron borrowernumber=1 Enroll to B with patron borrowernumber=2 Log in with patron 1 and hit: http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=1 => OK Now hit http://localhost:8080/cgi-bin/koha/clubs/clubs-tab.pl?borrowernumber=2 => oops Apply this patch, try again. The "borrowernumber" parameter is no longer used to fetch the club list. Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Created attachment 161688 [details] [review] Bug 35941: (QA follow-up) Tidy clubs-tab.pl Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
No regressions found, QA scripts happy and resolves the issue. Passing QA
Pushed to master for 24.05.00
Complex to backport to 22.11 due to patch 33895 which changed a lot of code. Is that bad if it's not backported?
(In reply to Frédéric Demians from comment #8) > Complex to backport to 22.11 due to patch 33895 which changed a lot of code. > Is that bad if it's not backported? I see it in now in 22.11.15
@Lucas I don't see this in 23.05.09
(In reply to Fridolin Somers from comment #10) > @Lucas > > I don't see this in 23.05.09 Will be released in v23.05.09-1