Bug 33702: Prevent ILL requests to be modified by somebody else
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Wed, 10 May 2023 05:37:57 +0000 (07:37 +0200)
committerMartin Renvoize <martin.renvoize@ptfs-europe.com>
Mon, 22 May 2023 15:06:41 +0000 (16:06 +0100)
commitf32c107197f99564c4c96e4abe0bd1b4bb795bea
treed2d2fe73e9e9b8c710d00fddd24b7fe43de4b290
parenta824b400e0efe3152fdfd145cbe3f0a3c39d1134
Bug 33702: Prevent ILL requests to be modified by somebody else

Same as previous patch, but for 'update' and 'cancreq'.
We remove the redirect, but here we only want to focus on the security
fix.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Confirmed. Without this patch a patron can modify and cancel any ILL
request in the OPAC. With this patch the patron is redirected to the
404 page if modification or cancellation is attempted.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
opac/opac-illrequests.pl