]> git.koha-community.org Git - koha.git/commit
Bug 18898 - Some permissions for Reports can be bypassed
authorDavid Cook <dcook@prosentient.com.au>
Thu, 27 Jul 2017 01:58:28 +0000 (11:58 +1000)
committerMason James <mtj@kohaaloha.com>
Wed, 20 Sep 2017 02:00:04 +0000 (14:00 +1200)
commit5af39bac74091095289a6aab44b3cfbefc016629
tree3c4a159683c346495444aafb0547e6336c0aa926
parente76959bdbbfa9288523f8a884b82914ad3ae5298
Bug 18898 - Some permissions for Reports can be bypassed

If you manually visit the following links when you only have
permission to run reports, you'll still be able to access the ability
to create and edit reports:

/cgi-bin/koha/reports/guided_reports.pl?phase=Create%20report%20from%20SQL
/cgi-bin/koha/reports/guided_reports.pl?phase=Edit%20SQL

This patch ties these 2 unaccounted for phases to the create_reports
permission.

With patch, issue no longer can be reproduced.
Signed-off-by: Marc VĂ©ron <veron@veron.ch>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 2fdfbaf0ddbf214c0efb9a3a3c2595a54517f795)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
(cherry picked from commit 4b71c9239708cd4d60190ed907fec03d1f8b08bc)
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Conflicts:
reports/guided_reports.pl
reports/guided_reports.pl