gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 29903: Prevent messages to be deleted from unauthorised users 

The "Delete" link is hidden but the controller does not do the necessary checks.

/cgi-bin/koha/circ/del_message.pl?message_id=1&borrowernumber=5&from=moremember

Test plan:
Create a message, see the "Delete" link, don't click it but copy it
Change logged in library and use the link
If AllowAllMessageDeletion is off you should be redirected to 403

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
This commit is contained in:
Jonathan Druart 2022-01-19 11:21:54 +01:00 committed by Kyle Hall
parent 26ddbf796a
commit a2b9a76431
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
circ/del_message.pl
View File

@ -39,6 +39,14 @@ my $borrowernumber = $input->param('borrowernumber');
my $message_id = $input->param('message_id');
my $message = Koha::Patron::Messages->find($message_id);
if ( $message
&& !C4::Context->preference('AllowAllMessageDeletion')
&& C4::Context->userenv->{'branch'} ne $message->branchcode )
{
print $input->redirect("/cgi-bin/koha/errors/403.pl");
exit;
}
$message->delete if $message;
if ( $input->param('from') eq "moremember" ) {