Koha-community/Koha
13
7
Fork 0
Code Issues Releases Wiki Activity

Bug 18898 - Some permissions for Reports can be bypassed

Browse source 
If you manually visit the following links when you only have
permission to run reports, you'll still be able to access the ability
to create and edit reports:

/cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL
/cgi-bin/koha/reports/guided_reports.pl?phase=Edit%20SQL

This patch ties these 2 unaccounted for phases to the create_reports
permission.

With patch, issue no longer can be reproduced.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
This commit is contained in:
David Cook 2017-07-27 11:58:28 +10:00 committed by Jonathan Druart
parent 19a7b498e1
commit 2fdfbaf0dd
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
reports/guided_reports.pl
View file

@ -53,7 +53,7 @@ my $usecache = Koha::Caches->get_instance->memcached_cache;
my $phase = $input->param('phase') // '';
my $flagsrequired;
if ( $phase eq 'Build new' ) {
if ( ( $phase eq 'Build new' ) || ( $phase eq 'Create report from SQL' ) || ( $phase eq 'Edit SQL' ) ){
$flagsrequired = 'create_reports';
}
elsif ( $phase eq 'Use saved' ) {