[Bug 11911] New: purchase suggestions permission can be bypassed
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11911 Bug ID: 11911 Summary: purchase suggestions permission can be bypassed Change sponsored?: --- Product: Koha Version: 3.12 Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Patrons Assignee: koha-bugs@lists.koha-community.org Reporter: nengard@gmail.com QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle.m.hall@gmail.com If I don’t give an account a permission to the purchase suggestions, but they have a copy of the link, such as http://mysite/cgi-bin/koha/suggestion/suggestion.pl?displayby=STATUS&bra..., they can go straight into the feature without permission. Shouldn’t the suggestion.pl be checking permissions upon loading? Do most pages function in this manner? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11911 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de Version|3.12 |master --- Comment #1 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Suggestions are tied to a very low level permission: flagsrequired => { catalogue => 1 } So everyone can access the page, even without any acq related permission. I think fixing this cleanly we should add a permission for the suggestions and make sure its set for all existing staff. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11911 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|purchase suggestions |Purchase suggestions can be |permission can be bypassed |accessed by all staff | |members / no specific | |permission -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11911 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|major |enhancement -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11911 Nicole C. Engard <nengard@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugs.koha-community. | |org/bugzilla3/show_bug.cgi? | |id=15506 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org