]> git.koha-community.org Git - koha.git/commit
Bug 22068: Prevent patrons to cancel article request they did not create
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Thu, 14 Feb 2019 20:03:17 +0000 (17:03 -0300)
committerNick Clemens <nick@bywatersolutions.com>
Wed, 10 Apr 2019 19:58:31 +0000 (19:58 +0000)
commit0b931d5de3c4fe9fa2b4823d9b8727b28a46aa7c
treec3dae39a7a0bd4361b6e8defa98f9a655c1cbd32
parentbdb157645538667cd23f8563ee6700e697a4adc8
Bug 22068: Prevent patrons to cancel article request they did not create

opac-article-request-cancel.pl doesn't check that the article request to
be cancelled actually belongs to the logged-in borrower. This results in
any logged-in user being able to cancel any article request just by
changing the id in the URL.

Test plan:
- Login with Patron P1, create an article request
- Cancel it
- Create another one
- Copy the cancellation link (must be /cgi-bin/koha/opac-article-request-cancel.pl?id=X)
- Login with Patron P2
- Hit the cancellation link
=> Without this patch the article request is cancelled
=> With this patch applied there is a 404 redirection

Note that the 404 will also appears when the article request id does not
exist.

Signed-off-by: Ere Maijala <ere.maijala@helsinki.fi>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
opac/opac-article-request-cancel.pl