gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 29542: Prevent access to private list to non authorized users 

The catalogue permission is not enough.

Test plan:
Create a private list owned by user A
Login with user B and hit (with XX the shelfid)
  /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX

You should get an error message "You do not have sufficient permission
to continue."

Login with user A
=> You should be able to send the list

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
This commit is contained in:
Jonathan Druart 2022-01-05 15:56:24 +01:00 committed by Andrew Fuerste-Henry
parent 4b1acb7a3a
commit 718c57367e
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
View File

@ -3,6 +3,7 @@
[% INCLUDE 'doc-head-close.inc' %]
</head>
<body id="lists_sendshelfform" class="lists" style="padding: 1em;">
[% INCLUDE 'blocking_errors.inc' %]
<div class="container">[% IF ( email ) %]
[% IF ( SENT ) %]

13
virtualshelves/sendshelf.pl
View File

@ -27,13 +27,16 @@ use Try::Tiny;
use C4::Auth;
use C4::Biblio;
use C4::Items;
use C4::Output;
use C4::Output qw(
output_html_with_http_headers
output_and_exit
);
use Koha::Email;
use Koha::Virtualshelves;
my $query = CGI->new;
my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
{
template_name => "virtualshelves/sendshelfform.tt",
query => $query,
@ -45,7 +48,10 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
my $shelfid = $query->param('shelfid');
my $to_address = $query->param('email');
my $dbh = C4::Context->dbh;
my $shelf = Koha::Virtualshelves->find( $shelfid );
output_and_exit( $query, $cookie, $template, 'insufficient_permission' )
if $shelf && !$shelf->can_be_viewed( $loggedinuser );
if ($to_address) {
my $comment = $query->param('comment');
@ -59,7 +65,6 @@ if ($to_address) {
}
);
my $shelf = Koha::Virtualshelves->find( $shelfid );
my $contents = $shelf->get_contents;
my $marcflavour = C4::Context->preference('marcflavour');
my $iso2709;