gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 28935: No filtering on patron's data on member entry pages 

Security patch. Follow-up for 28929.
Including correction for gonenoaddress and two others.
Includes unwanted fields too now.

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
This commit is contained in:
Marcel de Rooy 2021-09-01 16:04:31 +02:00 committed by Wainui Witika-Park
parent 03b06780fd
commit 67908307cf
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
members/memberentry.pl
View File

@ -222,7 +222,7 @@ if ( $op eq 'insert' || $op eq 'modify' || $op eq 'save' || $op eq 'duplicate' )
# remove keys from %newdata that is not part of patron's attributes
{
my @keys_to_delete = (
qr/^flags$/,
qr/^(borrowernumber|date_renewed|debarred|debarredcomment|flags|privacy|privacy_guarantor_fines|privacy_guarantor_checkouts|checkprevcheckout|updated_on|lastseen|lang|login_attempts|overdrive_auth_token|anonymized)$/, # Bug 28935
qr/^BorrowerMandatoryField$/,
qr/^category_type$/,
qr/^check_member$/,
@ -249,6 +249,7 @@ if ( $op eq 'insert' || $op eq 'modify' || $op eq 'save' || $op eq 'duplicate' )
qr/^guarantor_surname$/,
qr/^delete_guarantor$/,
);
push @keys_to_delete, map { qr/^$_$/ } split( /\s*\|\s*/, C4::Context->preference('PatronSelfRegistrationBorrowerUnwantedField') || q{} );
for my $regexp (@keys_to_delete) {
for (keys %newdata) {
delete($newdata{$_}) if /$regexp/;
@ -332,7 +333,7 @@ if ($op eq 'save' || $op eq 'insert'){
# If the cardnumber is blank, treat it as null.
$newdata{'cardnumber'} = undef if $newdata{'cardnumber'} =~ /^\s*$/;
if (my $error_code = checkcardnumber($newdata{cardnumber},$newdata{borrowernumber})){
if (my $error_code = checkcardnumber( $newdata{cardnumber}, $borrowernumber )){
push @errors, $error_code == 1
? 'ERROR_cardnumber_already_exists'
: $error_code == 2

5
opac/opac-memberentry.pl
View File

@ -496,7 +496,10 @@ sub ParseCgiForBorrower {
# Replace checkbox 'agreed' by datetime in gdpr_proc_consent
$borrower{gdpr_proc_consent} = dt_from_string if $borrower{gdpr_proc_consent} && $borrower{gdpr_proc_consent} eq 'agreed';
delete $borrower{flags};
delete $borrower{$_} for qw/borrowernumber date_renewed debarred debarredcomment flags privacy privacy_guarantor_fines privacy_guarantor_checkouts checkprevcheckout updated_on lastseen lang login_attempts overdrive_auth_token anonymized/; # See also members/memberentry.pl
delete $borrower{$_} for qw/dateenrolled dateexpiry borrowernotes opacnote sort1 sort2 sms_provider_id autorenew_checkouts gonenoaddress lost relationship/; # On OPAC only
delete $borrower{$_} for split( /\s*\|\s*/, C4::Context->preference('PatronSelfRegistrationBorrowerUnwantedField') || q{} );
return %borrower;
}