]> git.koha-community.org Git - koha.git/commit
Bug 18898 - Some permissions for Reports can be bypassed
authorDavid Cook <dcook@prosentient.com.au>
Thu, 27 Jul 2017 01:58:28 +0000 (11:58 +1000)
committerFridolin Somers <fridolin.somers@biblibre.com>
Tue, 12 Sep 2017 13:45:48 +0000 (15:45 +0200)
commit4b71c9239708cd4d60190ed907fec03d1f8b08bc
treeb6e2c35c778f8984b0fd08184f2f8859a008da84
parentafb2cb0c74b6a137652ec1a2e96fc480a5a50f96
Bug 18898 - Some permissions for Reports can be bypassed

If you manually visit the following links when you only have
permission to run reports, you'll still be able to access the ability
to create and edit reports:

/cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL
/cgi-bin/koha/reports/guided_reports.pl?phase=Edit%20SQL

This patch ties these 2 unaccounted for phases to the create_reports
permission.

With patch, issue no longer can be reproduced.
Signed-off-by: Marc VĂ©ron <veron@veron.ch>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 2fdfbaf0ddbf214c0efb9a3a3c2595a54517f795)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
reports/guided_reports.pl