gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 18898 - Some permissions for Reports can be bypassed 

If you manually visit the following links when you only have
permission to run reports, you'll still be able to access the ability
to create and edit reports:

/cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL
/cgi-bin/koha/reports/guided_reports.pl?phase=Edit%20SQL

This patch ties these 2 unaccounted for phases to the create_reports
permission.

With patch, issue no longer can be reproduced.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 2fdfbaf0dd)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
David Cook 2017-07-27 11:58:28 +10:00 committed by Fridolin Somers
parent afb2cb0c74
commit 4b71c92397
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
reports/guided_reports.pl
View File

@ -53,7 +53,7 @@ my $usecache = Koha::Caches->get_instance->memcached_cache;
my $phase = $input->param('phase') // '';
my $flagsrequired;
if ( $phase eq 'Build new' ) {
if ( ( $phase eq 'Build new' ) || ( $phase eq 'Create report from SQL' ) || ( $phase eq 'Edit SQL' ) ){
$flagsrequired = 'create_reports';
}
elsif ( $phase eq 'Use saved' ) {