https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43980 Bug ID: 43980 Summary: C4::Auth::_dispatch crashes (500) on hash (AND) permission when user lacks the module Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: johanna.raisa@koha-suomi.fi QA Contact: martin.renvoize@openfifth.co.uk CC: dpavlin@rot13.org Target Milestone: --- I noticed while doing this https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41869 bug that AND permissions are not handled correctly. Route permission (swagger): x-koha-authorization: permissions: reserveforothers: place_holds: 1 modify_holds_priority: 1 - Patron with both permissions → 200 OK - Patron with only place_holds → 403 Forbidden - Patron with no reserveforothers permission at all → 500 Internal Server Error (should be 403) `C4::Auth::_dispatch` mishandles a hash (AND) permission requirement when the user has no permission for that module at all. In the HASH branch: foreach my $key ( keys %{$required} ) { next if $flags == 1; my $rflags = $flags->{$key}; return 0 unless _dispatch( $require, $rflags ); } a user without the module has `$flags == 0` (integer), so `$flags->{$key}` tries to use `0` as a hash ref and throws, producing a 500 instead of 403. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.