gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
37,831 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Jonathan Druart 2ec64eaa23 Bug 29903: Prevent messages to be deleted from unauthorised users 
The "Delete" link is hidden but the controller does not do the necessary checks.

/cgi-bin/koha/circ/del_message.pl?message_id=1&borrowernumber=5&from=moremember

Test plan:
Create a message, see the "Delete" link, don't click it but copy it
Change logged in library and use the link
If AllowAllMessageDeletion is off you should be redirected to 403

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit a2b9a76431)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
(cherry picked from commit 5f9b8321ae6b2f5adc9e0c21dcd9f780b59c47d5)

Signed-off-by: Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz>
 		2022-01-30 23:53:45 +00:00
C4 Bug 29914: (QA follow-up) Add comment to explain last case 2022-01-26 04:19:50 +00:00
Koha Bug 29914: Make check_cookie_auth compare the userid 2022-01-26 04:18:46 +00:00
OpenILS Bug 9239 QA follow-up: remove stray debug code 2013-03-16 21:32:34 -04:00
acqui Bug 26997: Remove 0000-00-00 from aqorders.datecancellationprinted 2021-03-18 21:02:44 +01:00
admin Bug 27416: Make "Modify tag" and "Add tag" translatable 2021-02-02 00:37:15 +01:00
api Bug 23653: [19.11] use local copy of swagger v2 schema 2021-07-08 01:33:52 +00:00
authorities Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
basket Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
catalogue Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
cataloguing Bug 26605: Correctly URI-encode query string in call number browse plugin 2020-11-17 18:15:44 +13:00
circ Bug 29903: Prevent messages to be deleted from unauthorised users 2022-01-30 23:53:45 +00:00
clubs Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
course_reserves Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
debian Bug 28364: Make log4perl.conf belong to the instance user 2021-06-16 07:37:00 +00:00
docs Bug 28904: Fix typo and display 2021-12-01 13:47:20 +00:00
errors Bug 23329: Move error page to its own subroutine 2019-11-27 11:30:19 +00:00
etc Revert "Bug 27299: Remove tokenization for phrase register/index with ICU" 2021-02-04 18:35:03 +01:00
ill Bug 21460: (follow-up) Fix bugs found in QA 2019-04-25 10:46:56 +00:00
installer Increment version for 19.11.24 release 2022-01-04 04:32:38 +00:00
koha-tmpl Bug 29542: Prevent access to private list to non authorized users 2022-01-30 23:30:36 +00:00
labels Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
members Bug 29541: Prevent users from another group to access patron's images 2022-01-26 03:53:55 +00:00
misc Update release notes for 19.11.24 release 2022-01-04 05:44:14 +00:00
offline_circ Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
opac Bug 29544: (QA follow-up) Simplify code 2022-01-26 04:12:20 +00:00
patron_lists Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
patroncards Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
plugins Bug 25549: Add error reporting to plugins-home 2020-11-17 17:12:45 +13:00
reports Bug 28524: Escape 'rank' in cat_issues_top.pl 2021-07-22 07:47:35 +00:00
reserve Bug 29540: Raise flagsrequired in modrequest 2022-01-21 07:29:27 +00:00
reviews Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
rotating_collections Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
serials Bug 26604: "Generate next" button gives error on serials-collection.pl 2020-11-17 16:45:07 +13:00
services Bug 20019: use Modern::Perl in misc perl scripts 2018-02-05 09:47:08 -03:00
skel Bug 11078: Add locking to rebuild_zebra 2014-02-28 22:21:41 +00:00
suggestion Bug 22868: Move suggestions_manage subperm out of acquisition perm 2020-02-10 23:08:59 +00:00
svc Bug 26457: [19.11.x] Throw exception if update of issues table fails 2021-03-24 00:39:44 +01:00
t Bug 29914: Remove 'Use of uninitialized value ' warnings 2022-01-26 04:19:57 +00:00
tags Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
tmp/modified_authorities
…
tools Bug 26298: Don't set too_many_items_to_process if equal to limit 2021-02-11 02:48:46 +01:00
virtualshelves Bug 29542: Prevent access to private list to non authorized users 2022-01-30 23:30:36 +00:00
xt Bug 21576: Keep compatibility with QA script 2018-10-26 17:09:52 +00:00
.editorconfig Bug 12545: Add EditorConfig.org file to the source tree 2014-08-22 11:07:45 -03:00
.eslintrc.json Bug 23834: Add default ESLint configuration 2019-11-03 08:02:39 +00:00
.gitignore Bug 20427: Convert OPAC LESS to SCSS 2018-08-09 15:17:07 +00:00
.htaccess Fix file permissions: if it is not a script, it should not be executable. 2010-04-16 00:40:34 -04:00
.mailmap Bug 28386: Disambiguate Tomas and Blou 2021-06-30 05:23:21 +00:00
.scss-lint.yml Bug 21237: Clean up staff client SCSS 2018-08-24 16:23:25 +00:00
INSTALL Bug 17626: Remove existing install instructions and link to the wiki pages instead 2016-11-22 11:29:07 +00:00
Koha.pm Increment version for 19.11.24 release 2022-01-04 04:32:38 +00:00
LICENSE Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
MANIFEST.SKIP Bug 9546 : Updating make manifest tardist 2013-02-06 23:54:46 -05:00
Makefile.PL Bug 25792: Rename 'ttf-dejavu' package to 'fonts-dejavu' for Debian 11 2020-09-09 22:18:40 +12:00
README Bug 9440 - update Koha's LICENSE file from GPL2 to GPL3 2013-02-12 08:52:10 -05:00
README.md Bug 27092: Remove note about "synced repo" from README.md 2020-12-16 22:36:52 +01:00
README.robots Bug 6411 add another example to README.robots 2011-07-05 14:48:05 +12:00
about.pl Bug 28386: Sort authors by lastname || firstname 2021-06-30 05:24:20 +00:00
changelanguage.pl Bug 21299: (QA follow-up) Rename module and subroutine 2018-11-07 21:52:17 +00:00
fix-perl-path.PL Bug 9978: (followup) Replace license header with the correct license (GPLv3+) 2015-04-20 09:59:43 -03:00
gulpfile.js Bug 26228: Update gulpfile to work with Node.js v12 2020-09-09 16:04:42 +12:00
help.pl Bug 19817: Use the language from the interface if valid 2018-09-06 17:32:28 +00:00
koha_perl_deps.pl Bug 20019: use Modern::Perl in misc perl scripts 2018-02-05 09:47:08 -03:00
kohaversion.pl Bug 13758: Move the Koha version from kohaversion.pl 2015-05-07 11:39:04 -03:00
mainpage.pl Bug 24663: [19.11.x] Remove authnotrequired if set to 0 2020-08-25 15:45:46 +12:00
package.json Bug 26228: Update gulpfile to work with Node.js v12 2020-09-09 16:04:42 +12:00
rewrite-config.PL Bug 25792: Rename 'ttf-dejavu' package to 'fonts-dejavu' for Debian 11 2020-09-09 22:18:40 +12:00
yarn.lock Bug 26228: Update gulpfile to work with Node.js v12 2020-09-09 16:04:42 +12:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo