gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
41,787 Commits 39 Branches 720 Tags 6 GiB
Perl 44.2%
JavaScript 41.1%
HTML 6%
XSLT 3.1%
Vue 1.9%
Other 3.2%
Go to file
Jonathan Druart b730f85de8 Bug 29903: Prevent messages to be deleted from unauthorised users 
The "Delete" link is hidden but the controller does not do the necessary checks.

/cgi-bin/koha/circ/del_message.pl?message_id=1&borrowernumber=5&from=moremember

Test plan:
Create a message, see the "Delete" link, don't click it but copy it
Change logged in library and use the link
If AllowAllMessageDeletion is off you should be redirected to 403

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit a2b9a76431)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
 		2022-01-31 19:15:45 +01:00
C4 Bug 29914: (QA follow-up) Add comment to explain last case 2022-01-31 19:15:45 +01:00
Koha Bug 29914: Make check_cookie_auth compare the userid 2022-01-31 19:15:45 +01:00
acqui Bug 29283: (QA follow-up) Remove code duplication 2021-11-10 14:41:43 -10:00
admin Bug 29298: Add 'Managing library' column to table settings for histsearch 2021-10-22 16:16:41 -10:00
api Bug 29405: Fix date_renewed attribute format in patron spec 2021-11-19 14:16:56 -10:00
authorities Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
basket Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
bin Bug 20582: Turn Koha into a Mojolicious application 2020-10-06 12:00:04 +02:00
catalogue Bug 29284: (follow-up) Fix code that I copied from too 2022-01-31 00:45:57 +01:00
cataloguing Bug 29437: (QA follow-up) Remove Business::ISBN from addbooks 2022-01-31 01:09:39 +01:00
circ Bug 29903: Prevent messages to be deleted from unauthorised users 2022-01-31 19:15:45 +01:00
clubs Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
course_reserves Bug 25898: Fix new occurrences 2020-10-15 13:56:41 +02:00
debian Bug 28620: Remove trailing space when logging with log4perl 2021-08-02 18:48:46 -10:00
docs Bug 28904: Fix typo and display 2021-11-10 15:40:14 -10:00
errors
…
etc Bug 28620: Remove trailing space when logging with log4perl 2021-08-02 18:48:46 -10:00
ill Bug 22818: Add generation and sending of notices 2020-11-11 08:35:10 +01:00
installer Increment version for 20.11.13 release 2021-12-23 23:08:43 +01:00
koha-tmpl Bug 29542: Prevent access to private list to non authorized users 2022-01-31 19:15:45 +01:00
labels Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
members Bug 29541: Prevent users from another group to access patron's images 2022-01-31 19:15:44 +01:00
misc Update release notes for 20.11.13 release 2021-12-24 15:50:20 +01:00
offline_circ Bug 29255: Built-in offline circulation broken with SQL error 2021-11-19 13:59:58 -10:00
opac Bug 29544: (QA follow-up) Simplify code 2022-01-31 19:15:45 +01:00
patron_lists Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
patroncards Bug 27716: Update permissions for patroncards creator 2021-03-19 16:25:37 +01:00
plugins Bug 24633: Add support for gitlab searching of plugins 2020-11-06 15:55:17 +01:00
pos Bug 28181: Filter out archived debit types in point of sale 2021-05-12 16:38:02 +02:00
reports Bug 29204: (QA follow-up) Fix variable name 2021-11-19 11:06:12 -10:00
reserve Bug 29540: Raise flagsrequired in modrequest 2022-01-31 19:15:44 +01:00
reviews Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
rotating_collections Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
serials Bug 7806: Fix remaining occurrences of 0000-00-00 2021-03-04 10:24:48 +01:00
services Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
skel
…
suggestion Bug 7806: Fix remaining occurrences of 0000-00-00 2021-03-04 10:24:48 +01:00
svc Bug 29056: Remove the demo functionality leftovers 2021-10-08 16:31:50 -10:00
t Bug 29914: Remove 'Use of uninitialized value ' warnings 2022-01-31 19:15:45 +01:00
tags Bug 24663: Remove authnotrequired if set to 0 2020-09-03 10:40:35 +02:00
tmp/modified_authorities
…
tools Bug 28835: Fix ability to pass list contents to batch record modification 2021-08-13 10:12:45 -10:00
virtualshelves Bug 29542: Prevent access to private list to non authorized users 2022-01-31 19:15:45 +01:00
xt Bug 26971: Remove obsolete test file translatable-templates.t 2020-11-09 11:20:43 +01:00
.editorconfig
…
.eslintrc.json
…
.gitignore
…
.htaccess
…
.mailmap Bug 28386: Disambiguate Tomas and Blou 2021-06-23 07:35:21 +02:00
.perlcriticrc Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
.scss-lint.yml
…
INSTALL Bug 26617: Update INSTALL file to include koha-testing-docker and Gitlab links 2020-10-15 12:56:30 +02:00
Koha.pm Increment version for 20.11.13 release 2021-12-23 23:08:43 +01:00
LICENSE
…
MANIFEST.SKIP
…
Makefile.PL Bug 26363: Provide a systemd unit file for koha-worker for source installs 2021-03-02 08:31:29 +01:00
README
…
README.md Bug 27092: Remove note about "synced repo" from README.md 2020-11-25 16:31:58 +01:00
README.robots
…
about.pl Bug 28870: Move email address validation to a specific class method 2021-11-19 10:41:49 -10:00
app.psgi Bug 20582: Fix PSGI file when behind a reverse proxy 2020-10-06 12:00:04 +02:00
changelanguage.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
cpanfile Bug 29543: Add Mojo::JWT dependency 2022-01-31 19:15:44 +01:00
fix-perl-path.PL Bug 21395: Make perlcritic happy 2020-06-29 12:37:02 +02:00
gulpfile.js Bug 27072: Don't process staff interface CSS with rtlcss 2020-11-24 21:27:59 +01:00
help.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
koha_perl_deps.pl
…
kohaversion.pl Bug 26384: Fix executable flags 2020-09-11 09:56:56 +02:00
mainpage.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
package.json Bug 25067: Move PO file manipulation code into gulp tasks 2020-11-06 09:46:11 +01:00
rewrite-config.PL Bug 26290: Make Makefile.PL aware of SMTP configs 2020-10-02 15:27:18 +02:00
yarn.lock Bug 25067: Move PO file manipulation code into gulp tasks 2020-11-06 09:46:11 +01:00

README.md

Koha is a free software integrated library system (ILS).

Koha is distributed under the GNU GPL version 3 or later.

Note: Koha does not accept pull requests from git hosting sites.

Note: This project has its own bug tracker, to report a bug or submit a patch visit http://bugs.koha-community.org.

For guidelines on submitting patches for Koha please visit https://wiki.koha-community.org/wiki/SubmitingAPatch

The developers handbook can be found at https://wiki.koha-community.org/wiki/Developer_handbook

http://koha-community.org/

Koha Logo