In members/pay.tt one can see permission checks for manual credit and invoice : CAN_user_updatecharges_manual_invoice CAN_user_updatecharges_manual_credit This is missing from members/paycollect.tt. HTML is also missing classes manualcredit and manualinvoice.
Created attachment 162088 [details] [review] Bug 36076: paycollect.tt add permission checks for manual credit and invoice In members/pay.tt one can see permission checks for manual credit and invoice : CAN_user_updatecharges_manual_invoice CAN_user_updatecharges_manual_credit This is missing from members/paycollect.tt. HTML is also missing classes manualcredit and manualinvoice. Test plan : 1) Create a user with permissions to manage accounting but without manual_invoice and manual_credit 2) Go to a patron account with an invoice 3) Click on "Make a payment", you dont see tabs manual credit/invoice 4) Click on "Pay" in "Actions" column => Without patch you see tabs manual credit/invoice => With patch you do not see them
I set major because it is a permission leak
Created attachment 162252 [details] [review] Bug 36076: paycollect.tt add permission checks for manual credit and invoice In members/pay.tt one can see permission checks for manual credit and invoice : CAN_user_updatecharges_manual_invoice CAN_user_updatecharges_manual_credit This is missing from members/paycollect.tt. HTML is also missing classes manualcredit and manualinvoice. Test plan : 1) Create a user with permissions to manage accounting but without manual_invoice and manual_credit 2) Go to a patron account with an invoice 3) Click on "Make a payment", you dont see tabs manual credit/invoice 4) Click on "Pay" in "Actions" column => Without patch you see tabs manual credit/invoice => With patch you do not see them Signed-off-by: David Nind <david@davidnind.com>
Created attachment 162707 [details] [review] Bug 36076: paycollect.tt add permission checks for manual credit and invoice In members/pay.tt one can see permission checks for manual credit and invoice : CAN_user_updatecharges_manual_invoice CAN_user_updatecharges_manual_credit This is missing from members/paycollect.tt. HTML is also missing classes manualcredit and manualinvoice. Test plan : 1) Create a user with permissions to manage accounting (remaining_permissions under updatecharges) but without manual_invoice and manual_credit 2) Go to a patron account with an invoice 3) Click on "Make a payment", you dont see tabs manual credit/invoice 4) Click on "Pay" in "Actions" column => Without patch you see tabs manual credit/invoice => With patch you do not see them Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Works, makes sense, QA script happy, code looks good, passing QA :)
(In reply to Fridolin Somers from comment #2) > I set major because it is a permission leak It's just displaying links which don't work because the server checks the permission before sending the page. And even if it did work, the post request for invoices and credit are also protected server side. (checked by loading the form, removing the permission and trying to make a manual invoice/credit)
Pushed for 24.05! Well done everyone, thank you!
Pushed to 23.11.x for 23.11.04
Backported to 23.05.x for upcoming 23.05.10.