https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36076 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |fridolin.somers@biblibre.co |ity.org |m Status|NEW |ASSIGNED -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36076 --- Comment #1 from Fridolin Somers <fridolin.somers@biblibre.com> --- Created attachment 162088 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162088&action=edit Bug 36076: paycollect.tt add permission checks for manual credit and invoice In members/pay.tt one can see permission checks for manual credit and invoice : CAN_user_updatecharges_manual_invoice CAN_user_updatecharges_manual_credit This is missing from members/paycollect.tt. HTML is also missing classes manualcredit and manualinvoice. Test plan : 1) Create a user with permissions to manage accounting but without manual_invoice and manual_credit 2) Go to a patron account with an invoice 3) Click on "Make a payment", you dont see tabs manual credit/invoice 4) Click on "Pay" in "Actions" column => Without patch you see tabs manual credit/invoice => With patch you do not see them -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36076 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36076 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #162252|0 |1 is obsolete| | --- Comment #4 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Created attachment 162707 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=162707&action=edit Bug 36076: paycollect.tt add permission checks for manual credit and invoice In members/pay.tt one can see permission checks for manual credit and invoice : CAN_user_updatecharges_manual_invoice CAN_user_updatecharges_manual_credit This is missing from members/paycollect.tt. HTML is also missing classes manualcredit and manualinvoice. Test plan : 1) Create a user with permissions to manage accounting (remaining_permissions under updatecharges) but without manual_invoice and manual_credit 2) Go to a patron account with an invoice 3) Click on "Make a payment", you dont see tabs manual credit/invoice 4) Click on "Pay" in "Actions" column => Without patch you see tabs manual credit/invoice => With patch you do not see them Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36076 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|major |normal --- Comment #6 from Victor Grousset/tuxayo <victor@tuxayo.net> --- (In reply to Fridolin Somers from comment #2)

I set major because it is a permission leak

It's just displaying links which don't work because the server checks the permission before sending the page. And even if it did work, the post request for invoices and credit are also protected server side. (checked by loading the form, removing the permission and trying to make a manual invoice/credit) -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36076 --- Comment #7 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36076 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com Status|Pushed to stable |Pushed to oldstable Version(s)|24.05.00,23.11.04 |24.05.00,23.11.04,23.05.10 released in| | --- Comment #9 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 23.05.x for upcoming 23.05.10. -- You are receiving this mail because: You are watching all bug changes.