gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 29542: Prevent access to private list to non authorized users 

The catalogue permission is not enough.

Test plan:
Create a private list owned by user A
Login with user B and hit (with XX the shelfid)
  /cgi-bin/koha/virtualshelves/sendshelf.pl?shelfid=XX

You should get an error message "You do not have sufficient permission
to continue."

Login with user A
=> You should be able to send the list

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
Jonathan Druart 2022-01-05 15:56:24 +01:00 committed by Fridolin Somers
parent 2c3a11f138
commit ef85122b1d
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/sendshelfform.tt
View File

@ -3,6 +3,7 @@
[% INCLUDE 'doc-head-close.inc' %]
</head>
<body id="lists_sendshelfform" class="lists" style="padding: 1em;">
[% INCLUDE 'blocking_errors.inc' %]
<div class="container">[% IF ( email ) %]
[% IF ( SENT ) %]

13
virtualshelves/sendshelf.pl
View File

@ -31,13 +31,16 @@ use C4::Biblio qw(
GetMarcSubjects
);
use C4::Items qw( GetItemsInfo );
use C4::Output qw( output_html_with_http_headers );
use C4::Output qw(
output_html_with_http_headers
output_and_exit
);
use Koha::Email;
use Koha::Virtualshelves;
my $query = CGI->new;
my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
{
template_name => "virtualshelves/sendshelfform.tt",
query => $query,
@ -49,7 +52,10 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user(
my $shelfid = $query->param('shelfid');
my $to_address = $query->param('email');
my $dbh = C4::Context->dbh;
my $shelf = Koha::Virtualshelves->find( $shelfid );
output_and_exit( $query, $cookie, $template, 'insufficient_permission' )
if $shelf && !$shelf->can_be_viewed( $loggedinuser );
if ($to_address) {
my $comment = $query->param('comment');
@ -63,7 +69,6 @@ if ($to_address) {
}
);
my $shelf = Koha::Virtualshelves->find( $shelfid );
my $contents = $shelf->get_contents;
my $marcflavour = C4::Context->preference('marcflavour');
my $iso2709;