gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 14440: get_template_and_user can not have an empty template_name (quote*_ajax.pl) 

This patch uses check_api_auth instead of get_template_and_user.

Test plan:
Confirm that you are still able to access to the quote editor with the
edit_quotes permission.
Confirm that you are not if you don't have the permission.

wget your_url/cgi-bin/koha/tools/quotes/quotes_ajax.pl
should return "403 : Forbidden."

Signed-off-by: Indranil Das Gupta (L2C2 Technologies) <indradg@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
This commit is contained in:
Jonathan Druart 2015-06-24 11:03:22 +02:00 committed by Tomas Cohen Arazi
parent f1acb5615d
commit 08871a324f
2 changed files with 12 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
tools/quotes/quotes-upload_ajax.pl
View File

@ -32,16 +32,12 @@ use C4::Output;
my $cgi = new CGI;
my $dbh = C4::Context->dbh;
my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
{
template_name => "",
query => $cgi,
type => "intranet",
authnotrequired => 0,
flagsrequired => { tools => 'edit_quotes' },
debug => 1,
}
);
my ( $status, $cookie, $sessionID ) = C4::Auth::check_api_auth( $cgi, { tools => 'edit_quotes' } );
unless ($status eq "ok") {
print $cgi->header(-type => 'application/json', -status => '403 Forbidden');
print to_json({ auth_status => $status });
exit 0;
}
my $success = 'true';

16
tools/quotes/quotes_ajax.pl
View File

@ -31,16 +31,12 @@ my $cgi = CGI->new;
my $dbh = C4::Context->dbh;
my $sort_columns = ["id", "source", "text", "timestamp"];
my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
{
template_name => "",
query => $cgi,
type => "intranet",
authnotrequired => 0,
flagsrequired => { tools => 'edit_quotes' },
debug => 1,
}
);
my ( $status, $cookie, $sessionID ) = C4::Auth::check_api_auth( $cgi, { tools => 'edit_quotes' } );
unless ($status eq "ok") {
print $cgi->header(-type => 'application/json', -status => '403 Forbidden');
print to_json({ auth_status => $status });
exit 0;
}
# NOTE: This is a collection of ajax functions for use with tools/quotes.pl