gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/circ
History
Jonathan Druart b730f85de8 Bug 29903: Prevent messages to be deleted from unauthorised users 
The "Delete" link is hidden but the controller does not do the necessary checks.

/cgi-bin/koha/circ/del_message.pl?message_id=1&borrowernumber=5&from=moremember

Test plan:
Create a message, see the "Delete" link, don't click it but copy it
Change logged in library and use the link
If AllowAllMessageDeletion is off you should be redirected to 403

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
(cherry picked from commit a2b9a76431)
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
 		2022-01-31 19:15:45 +01:00
..
add_message.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
article-request-slip.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
article-requests.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
bookcount.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
branchoverdues.pl Bug 27548: "use of uninitialized value" warning on branchoverdues.pl 2021-02-05 17:12:31 +01:00
branchtransfers.pl Bug 25690: (QA follow-up) PROCESSED -> PROCESSING for consistency 2021-03-08 16:35:52 +01:00
checkout-notes.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
circulation-home.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
circulation.pl Bug 25690: Make CanBookBeIssued return In Processing state as needing confirmation 2021-03-08 16:35:52 +01:00
del_message.pl Bug 29903: Prevent messages to be deleted from unauthorised users 2022-01-31 19:15:45 +01:00
hold-transfer-slip.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
offline-mf.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
offline.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
on-site_checkouts.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
overdue.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
pendingreserves.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
renew.pl Bug 27549: "use of uninitialized value" warning on renew.pl 2021-02-05 17:13:19 +01:00
request-article.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
reserveratios.pl Bug 25760: (bug 15422 follow-up) Display record with hold ratio greater than or equal to the value entered 2021-05-12 16:40:42 +02:00
returns.pl Bug 21883: Pass the item to the template 2021-04-29 15:11:45 +02:00
set-library.pl Bug 24786: (follow-up) Cache the register_name in the session 2020-11-06 15:40:00 +01:00
transfer-slip.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
transferstoreceive.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
view_holdsqueue.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00
waitingreserves.pl Bug 7806: Fix remaining occurrences of 0000-00-00 2021-03-04 10:24:48 +01:00
ysearch.pl Bug 25898: Prohibit indirect object notation 2020-10-15 12:56:30 +02:00