https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43723 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Depends on| |43425 --- Comment #1 from Jonathan Druart <jonathan.druart@gmail.com> --- This is not a security bug but depends on one. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43723 --- Comment #2 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 207273 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=207273&action=edit Bug 43723: Use bitwise test in IsSuperLibrarian Superlibrarian is bit 0 of borrowers.flags. Test it with & 1 like the other flag checks (e.g. Koha::Patron->permissions) instead of % 2. No behaviour change expected, unless there are old entries in the borrowers table that predate the UI change that forbid the selection of superlibrarian and other top-level permissions? -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43723 Nick Clemens (kidclamp) <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #207273|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43723 --- Comment #4 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- Created attachment 207742 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=207742&action=edit Bug 43723: (QA follow-up) Check bitwise rather than exact Restoring the change in 43723 to prevent any odd value from granting superlibrarian permissions Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43723 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl Status|Signed Off |Failed QA --- Comment #5 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- [FAIL] C4/Context.pm FAIL pod_coverage sub import has no pod coverage. sub _common_config has no pod coverage. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43723 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #7 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Hi there, I am not sure whether it's just me but I find the first commit message (Use bitwise test in IsSuperLibrarian) confusing. It sounds like it switches to `& 1`, but the diff does `== 1`. Can this be updated? I am also not sure whether this is a problem, but IsSuperLibrarian can now disagree with the other superlibrarian checks: perl -MC4::Context -MC4::Auth -MKoha::Database -MKoha::Patrons -e ' my $s = Koha::Database->schema; $s->txn_begin; my $p = Koha::Patrons->search->next; $p->flags(3)->store; C4::Context->set_userenv( $p->borrowernumber, $p->userid, $p->cardnumber, "", "", "", "", 3 ); my %r = ( getuserflags => C4::Auth::getuserflags( 3, $p->userid )->{superlibrarian}, haspermission => C4::Auth::haspermission( $p->userid, { superlibrarian => 1 } ), has_permission => $p->has_permission( { superlibrarian => 1 } ), is_superlibrarian => $p->is_superlibrarian, IsSuperLibrarian => C4::Context->IsSuperLibrarian, ); $r{permissions} = $p->permissions->{superlibrarian} if $p->can("permissions"); printf "%-18s %d\n", $_, ( $r{$_} ? 1 : 0 ) for sort keys %r; $s->txn_rollback;' IsSuperLibrarian 0 getuserflags 1 has_permission 1 haspermission 1 is_superlibrarian 1 permissions 1 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43723 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43723 --- Comment #9 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 210212 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=210212&action=edit Bug 43723: Only consider flags == 1 as superlibrarian Superlibrarian was detected by testing bit 0 of borrowers.flags (`% 2` in C4::Context::IsSuperLibrarian, `& 2**$bit` in C4::Auth::getuserflags and Koha::Patron->permissions), so any odd value (e.g. 3 or 421) was considered superlibrarian. Only flags == 1 means superlibrarian. Test for that in IsSuperLibrarian, getuserflags and Koha::Patron->permissions, so that haspermission, Koha::Patron->has_permission and is_superlibrarian agree. The other bits of an odd value are still granted (flags=3 gives circulate). The permissions page (members/member-flags.pl) no longer ticks superlibrarian for such values. This changes behaviour for patrons with an odd flags value other than 1, which could come from old entries in the borrowers table that predate the UI change that forbid the selection of superlibrarian together with other top-level permissions. Test plan: 1. Create a staff patron with a username and password, e.g. "flagtest", and give them the "catalogue" permission so they can log in. 2. Set their flags to an odd value other than 1: UPDATE borrowers SET flags = 3 WHERE userid = 'flagtest'; 3. Without the patch: a. Log in to the staff interface as flagtest => You have full access: Administration > System preferences opens b. As koha, open flagtest's "Set permissions" page => "Access to all librarian functions" (superlibrarian) is ticked 4. Apply the patch, restart_all 5. Log in again as flagtest => Circulation is accessible (bit 1 is still granted) => Administration > System preferences is not accessible (permission denied), and the Administration link is not shown 6. As koha, open flagtest's "Set permissions" page => superlibrarian is not ticked, "circulate" is ticked Note: saving this page will store flags = 2 (superlibrarian bit removed) 7. UPDATE borrowers SET flags = 1 WHERE userid = 'flagtest'; Log in again as flagtest => Full access again: flags = 1 is still superlibrarian 8. Run the tests: prove t/Context.t t/db_dependent/Koha/Patron.t t/db_dependent/Auth.t \ t/db_dependent/Koha/Patrons.t t/db_dependent/Koha/Patrons/Import.t => All pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> -- You are receiving this mail because: You are watching all bug changes.