gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 29542: Prevent access to private list to non authorized users 

The catalogue permission is not enough.

Test plan:
Create a private list owned by user A
Login with user B and hit (with XX the shelfid)
  /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX

You should get an error message "You do not have sufficient permission
to continue."

Login with user A
=> You should be able to send the list

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit 6ca49b550e)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
This commit is contained in:
Jonathan Druart 2022-01-05 15:56:24 +01:00 committed by Victor Grousset/tuxayo
parent 3afe1ccb6d
commit 0bb3edf936
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
View File

@ -2,6 +2,7 @@
[% INCLUDE 'doc-head-close.inc' %]
</head>
<body id="lists_sendshelfform" class="lists" style="padding: 1em;">
[% INCLUDE 'blocking_errors.inc' %]
<div class="container">[% IF ( email ) %]
[% IF ( SENT ) %]

8
virtualshelves/sendshelf.pl
View File

@ -33,7 +33,7 @@ use Koha::Virtualshelves;
my $query = CGI->new;
my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
{
template_name => "virtualshelves/sendshelfform.tt",
query => $query,
@ -45,7 +45,10 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
my $shelfid = $query->param('shelfid');
my $to_address = $query->param('email');
my $dbh = C4::Context->dbh;
my $shelf = Koha::Virtualshelves->find( $shelfid );
output_and_exit( $query, $cookie, $template, 'insufficient_permission' )
if $shelf && !$shelf->can_be_viewed( $loggedinuser );
if ($to_address) {
my $comment = $query->param('comment');
@ -59,7 +62,6 @@ if ($to_address) {
}
);
my $shelf = Koha::Virtualshelves->find( $shelfid );
my $contents = $shelf->get_contents;
my $marcflavour = C4::Context->preference('marcflavour');
my $iso2709;