gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 10565: (follow-up) add new user permission for patron list management 

This patch adds a new user permission for patron list management,
tools => manage_patron_lists.

This closes a security issue with the original patch series where
patron lists and their contents could be retrieved and modified
without requiring authentication of any sort.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
This commit is contained in:
Galen Charlton 2013-10-14 22:31:37 +00:00
parent 353e000e2a
commit a10773dc77
17 changed files with 36 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
installer/data/mysql/de-DE/mandatory/userpermissions.sql
View File

@ -43,6 +43,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES
(13, 'moderate_tags', 'Von Benutzern vergebene Tags moderieren'),
(13, 'rotating_collections', 'Wandernde Sammlungen verwalten'),
(13, 'upload_local_cover_images', 'Eigene Coverbilder hochladen'),
(13, 'manage_patron_lists', 'Add, edit and delete patron lists and their contents'),
(15, 'check_expiration', 'Ablauf eines Abonnements prüfen'),
(15, 'claim_serials', 'Fehlende Hefte reklamieren'),
(15, 'create_subscription', 'Neues Abonnement anlegen'),

1
installer/data/mysql/en/mandatory/userpermissions.sql
View File

@ -43,6 +43,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES
(13, 'moderate_tags', 'Moderate patron tags'),
(13, 'rotating_collections', 'Manage rotating collections'),
(13, 'upload_local_cover_images', 'Upload local cover images'),
(13, 'manage_patron_lists', 'Add, edit and delete patron lists and their contents'),
(15, 'check_expiration', 'Check the expiration of a serial'),
(15, 'claim_serials', 'Claim missing serials'),
(15, 'create_subscription', 'Create a new subscription'),

1
installer/data/mysql/es-ES/mandatory/userpermissions.sql
View File

@ -43,6 +43,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES
(13, 'moderate_tags', 'Moderate patron tags'),
(13, 'rotating_collections', 'Manage rotating collections'),
(13, 'upload_local_cover_images', 'Upload local cover images'),
(13, 'manage_patron_lists', 'Add, edit and delete patron lists and their contents'),
(15, 'check_expiration', 'Check the expiration of a serial'),
(15, 'claim_serials', 'Claim missing serials'),
(15, 'create_subscription', 'Create a new subscription'),

1
installer/data/mysql/fr-FR/1-Obligatoire/userpermissions.sql
View File

@ -43,6 +43,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES
(13, 'items_batchmod', 'Modifier les exemplaires par lot'),
(13, 'items_batchdel', 'Supprimer les exemplaires par lot'),
(13, 'upload_local_cover_images', 'Téléchargement des images de couverture'),
(13, 'manage_patron_lists', 'Add, edit and delete patron lists and their contents'),
(15, 'check_expiration', 'Contrôler l''expiration d''un périodique'),
(15, 'claim_serials', 'Réclamer les périodiques manquants'),
(15, 'create_subscription', 'Créer de nouveaux abonnements'),

1
installer/data/mysql/it-IT/necessari/userpermissions.sql
View File

@ -45,6 +45,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES
(13, 'moderate_tags', 'Modera i tag inseriti dagli utenti'),
(13, 'rotating_collections', 'Gestisci le collezioni circolanti (rotating collections)'),
(13, 'upload_local_cover_images', 'Carica copertine in locale'),
(13, 'manage_patron_lists', 'Add, edit and delete patron lists and their contents'),
(15, 'check_expiration', 'Controlla la scadenza di una risora in continuazione'),
(15, 'claim_serials', 'Richiedi i fascicoli non arrivati'),
(15, 'create_subscription', 'Crea un nuovo abbonamento'),

1
installer/data/mysql/nb-NO/1-Obligatorisk/userpermissions.sql
View File

@ -63,6 +63,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES
(13, 'moderate_tags', 'Behandle tagger fra lånere'),
(13, 'rotating_collections', 'Administrere roterende samlinger'),
(13, 'upload_local_cover_images', 'Laste opp lokale omslagsbilder'),
(13, 'manage_patron_lists', 'Add, edit and delete patron lists and their contents'),
(15, 'check_expiration', 'Sjekke utløpsdato for et periodikum'),
(15, 'claim_serials', 'Purre manglende tidsskrifthefter'),
(15, 'create_subscription', 'Opprette abonnementer'),

1
installer/data/mysql/pl-PL/mandatory/userpermissions.sql
View File

@ -44,6 +44,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES
(16, 'execute_reports', 'Execute SQL reports'),
(13, 'rotating_collections', 'Manage rotating collections'),
(13, 'upload_local_cover_images', 'Upload local cover images'),
(13, 'manage_patron_lists', 'Add, edit and delete patron lists and their contents'),
(15, 'check_expiration', 'Check the expiration of a serial'),
(15, 'claim_serials', 'Claim missing serials'),
(15, 'create_subscription', 'Create a new subscription'),

1
installer/data/mysql/ru-RU/mandatory/permissions_and_user_flags.sql
View File

@ -69,6 +69,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES
(13, 'moderate_tags', 'Moderate patron tags'),
(13, 'rotating_collections', 'Manage rotating collections'),
(13, 'upload_local_cover_images', 'Upload local cover images'),
(13, 'manage_patron_lists', 'Add, edit and delete patron lists and their contents'),
(15, 'check_expiration', 'Check the expiration of a serial'),
(15, 'claim_serials', 'Claim missing serials'),
(15, 'create_subscription', 'Create a new subscription'),

1
installer/data/mysql/uk-UA/mandatory/permissions_and_user_flags.sql
View File

@ -69,6 +69,7 @@ INSERT INTO permissions (module_bit, code, description) VALUES
(13, 'moderate_tags', 'Moderate patron tags'),
(13, 'rotating_collections', 'Manage rotating collections'),
(13, 'upload_local_cover_images', 'Upload local cover images'),
(13, 'manage_patron_lists', 'Add, edit and delete patron lists and their contents'),
(15, 'check_expiration', 'Check the expiration of a serial'),
(15, 'claim_serials', 'Claim missing serials'),
(15, 'create_subscription', 'Create a new subscription'),

5
installer/data/mysql/updatedatabase.pl
View File

@ -7297,6 +7297,11 @@ if ( CheckVersion($DBversion) ) {
ADD CONSTRAINT patron_list_patrons_ibfk_2 FOREIGN KEY (borrowernumber) REFERENCES borrowers (borrowernumber) ON DELETE CASCADE ON UPDATE CASCADE;
});
$dbh->do(q{
INSERT INTO permissions (module_bit, code, description) VALUES
(13, 'manage_patron_lists', 'Add, edit and delete patron lists and their contents')
});
print "Upgrade to $DBversion done (Bug 10565 - Add a 'Patron List' feature for storing and manipulating collections of patrons)\n";
SetVersion($DBversion);
}

10
koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt
View File

@ -110,10 +110,13 @@ function CheckForm() {
[% END %]
[% IF ( resultsloop ) %]
[% IF (CAN_user_tools_manage_patron_lists) %]
<form id="add-patrons-to-list-form" method="post" action="member.pl" onsubmit="return CheckForm()">
[% END %]
<div id="searchheader">
<h3>Results [% from %] to [% to %] of [% numresults %] found for [% IF ( member ) %]'<span class="ex">[% member %]</span>'[% END %][% IF ( surname ) %]'<span class="ex">[% surname %]</span>'[% END %]</h3>
[% IF (CAN_user_tools_manage_patron_lists) %]
<div>
<a href="javascript:void(0)" onclick="$('.selection').prop('checked', true)">Select all</a>
|
@ -149,13 +152,16 @@ function CheckForm() {
<input id="add_to_patron_list_submit" type="submit" class="submit" value="Save">
</span>
</div>
[% END %]
</div>
<div class="searchresults">
<table id="memberresultst">
<thead>
<tr>
[% IF (CAN_user_tools_manage_patron_lists) %]
<th>&nbsp</th>
[% END %]
<th>Card</th>
<th>Name</th>
<th>Cat</th>
@ -178,7 +184,9 @@ function CheckForm() {
<tr>
[% END %]
[% END %]
[% IF (CAN_user_tools_manage_patron_lists) %]
<td><input type="checkbox" class="selection" name="borrowernumber" value="[% resultsloo.borrowernumber %]" /></td>
[% END %]
<td>[% resultsloo.cardnumber %]</td>
<td style="white-space: nowrap;">
<a href="/cgi-bin/koha/members/moremember.pl?borrowernumber=[% resultsloo.borrowernumber %]">
@ -206,7 +214,9 @@ function CheckForm() {
</table>
<div class="pages">[% IF ( multipage ) %][% paginationbar %][% END %]</div>
</div>
[% IF (CAN_user_tools_manage_patron_lists) %]
</form>
[% END %]
[% ELSE %]
[% IF ( searching ) %]
<div class="dialog alert">No results found</div>

2
koha-tmpl/intranet-tmpl/prog/en/modules/tools/tools-home.tt
View File

@ -15,8 +15,10 @@
<div class="yui-u first">
<h3>Patrons and circulation</h3>
<dl>
[% IF (CAN_user_tools_manage_patron_lists) %]
<dt><a href="/cgi-bin/koha/patron_lists/lists.pl">Patron lists</a>
<dd>Manage lists of patrons.</dd>
[% END %]
[% IF ( CAN_user_tools_moderate_comments ) %]
<dt><a href="/cgi-bin/koha/reviews/reviewswaiting.pl">Comments</a> [% IF ( pendingcomments ) %]<span class="holdcount"><a href="/cgi-bin/koha/reviews/reviewswaiting.pl">[% pendingcomments %]</a></span>[% END %]</dt>

3
patron_lists/add-modify.pl
View File

@ -32,7 +32,8 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
template_name => "patron_lists/add-modify.tt",
query => $cgi,
type => "intranet",
authnotrequired => 1,
authnotrequired => 0,
flagsrequired => { tools => 'manage_patron_lists' },
}
);

3
patron_lists/delete.pl
View File

@ -32,7 +32,8 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
template_name => "patron_lists/lists.tt",
query => $cgi,
type => "intranet",
authnotrequired => 1,
authnotrequired => 0,
flagsrequired => { tools => 'manage_patron_lists' },
}
);

3
patron_lists/list.pl
View File

@ -32,7 +32,8 @@ my ( $template, $logged_in_user, $cookie ) = get_template_and_user(
template_name => "patron_lists/list.tt",
query => $cgi,
type => "intranet",
authnotrequired => 1,
authnotrequired => 0,
flagsrequired => { tools => 'manage_patron_lists' },
}
);

3
patron_lists/lists.pl
View File

@ -32,7 +32,8 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
template_name => "patron_lists/lists.tt",
query => $cgi,
type => "intranet",
authnotrequired => 1,
authnotrequired => 0,
flagsrequired => { tools => 'manage_patron_lists' },
}
);

3
patron_lists/patrons.pl
View File

@ -32,7 +32,8 @@ my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
template_name => "patron_lists/add-modify.tt",
query => $cgi,
type => "intranet",
authnotrequired => 1,
authnotrequired => 0,
flagsrequired => { tools => 'manage_patron_lists' },
}
);