From ccb64c18ee79adf22457ad7fb4fb248e22bcd9ce Mon Sep 17 00:00:00 2001 From: Joe Atzberger Date: Thu, 30 Apr 2009 10:04:38 -0500 Subject: [PATCH] Bug 3177 - haspermission offers bogus option $intflags was never used or returned if hashref instead of userid was passed. Also cleaned up needless passing of $dbh. Signed-off-by: Galen Charlton --- C4/Auth.pm | 41 ++++++++++++++++------------------------- members/deletemem.pl | 3 ++- members/memberentry.pl | 2 +- 3 files changed, 19 insertions(+), 27 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 1c82a1d5d1..a5ac005bd9 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1,7 +1,3 @@ - -# -*- tab-width: 8 -*- -# NOTE: This file uses 8-character tabs; do not change the tab size! - package C4::Auth; # Copyright 2000-2002 Katipo Communications @@ -592,7 +588,7 @@ sub checkauth { $cookie = $query->cookie( CGISESSID => $session->id ); $session->param('lasttime',time()); unless ( $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... - $flags = haspermission( $dbh, $userid, $flagsrequired ); + $flags = haspermission($userid, $flagsrequired); if ($flags) { $loggedin = 1; } else { @@ -612,7 +608,7 @@ sub checkauth { my ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password ); if ($return) { _session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},localtime); - if ( $flags = haspermission( $dbh, $userid, $flagsrequired ) ) { + if ( $flags = haspermission($userid, $flagsrequired) ) { $loggedin = 1; } else { @@ -957,7 +953,7 @@ sub check_api_auth { } else { my $cookie = $query->cookie( CGISESSID => $session->id ); $session->param('lasttime',time()); - my $flags = haspermission( $dbh, $userid, $flagsrequired ); + my $flags = haspermission($userid, $flagsrequired); if ($flags) { return ("ok", $cookie, $sessionID); } else { @@ -980,7 +976,7 @@ sub check_api_auth { return ("failed", undef, undef); } my ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password ); - if ($return and haspermission( $dbh, $userid, $flagsrequired)) { + if ($return and haspermission($userid, $flagsrequired)) { my $session = get_session(""); return ("failed", undef, undef) unless $session; @@ -1175,7 +1171,7 @@ sub check_cookie_auth { return ("expired", undef); } else { $session->param('lasttime',time()); - my $flags = haspermission( $dbh, $userid, $flagsrequired ); + my $flags = haspermission($userid, $flagsrequired); if ($flags) { return ("ok", $sessionID); } else { @@ -1288,10 +1284,12 @@ sub checkpw { =item getuserflags - $authflags = getuserflags($flags,$dbh); + my $authflags = getuserflags($flags, $userid, [$dbh]); + Translates integer flags into permissions strings hash. C<$flags> is the integer userflags value ( borrowers.userflags ) +C<$userid> is the members.userid, used for building subpermissions C<$authflags> is a hashref of permissions =cut @@ -1299,7 +1297,7 @@ C<$authflags> is a hashref of permissions sub getuserflags { my $flags = shift; my $userid = shift; - my $dbh = shift; + my $dbh = @_ ? shift : C4::Context->dbh; my $userflags; $flags = 0 unless $flags; my $sth = $dbh->prepare("SELECT bit, flag, defaulton FROM userflags"); @@ -1404,9 +1402,9 @@ sub get_all_subpermissions { =item haspermission - $flags = ($dbh,$member,$flagsrequired); + $flags = ($userid, $flagsrequired); -C<$member> may be either userid or overloaded with $borrower hashref from GetMemberDetails. +C<$userid> the userid of the member C<$flags> is a hashref of required flags like C<$borrower-<{authflags}> Returns member's flags or 0 if a permission is not met. @@ -1414,22 +1412,15 @@ Returns member's flags or 0 if a permission is not met. =cut sub haspermission { - my ( $dbh, $userid, $flagsrequired ) = @_; - my ($flags,$intflags); - $dbh=C4::Context->dbh unless($dbh); - if(ref($userid)) { - $intflags = $userid->{'flags'}; - } else { - my $sth = $dbh->prepare("SELECT flags FROM borrowers WHERE userid=?"); - $sth->execute($userid); - my ($intflags) = $sth->fetchrow; - $flags = getuserflags( $intflags, $userid, $dbh ); - } + my ($userid, $flagsrequired) = @_; + my $sth = C4::Context->dbh->prepare("SELECT flags FROM borrowers WHERE userid=?"); + $sth->execute($userid); + my $flags = getuserflags( $sth->fetchrow(), $userid ); if ( $userid eq C4::Context->config('user') ) { # Super User Account from /etc/koha.conf $flags->{'superlibrarian'} = 1; } - if ( $userid eq 'demo' && C4::Context->config('demo') ) { + elsif ( $userid eq 'demo' && C4::Context->config('demo') ) { # Demo user that can do "anything" (demo=1 in /etc/koha.conf) $flags->{'superlibrarian'} = 1; } diff --git a/members/deletemem.pl b/members/deletemem.pl index fe0cbeebf4..e41157b386 100755 --- a/members/deletemem.pl +++ b/members/deletemem.pl @@ -22,6 +22,7 @@ # Suite 330, Boston, MA 02111-1307 USA use strict; +# use warnings; # FIXME use CGI; use C4::Context; @@ -49,7 +50,7 @@ my ($bor)=GetMemberDetails($member,''); my $flags=$bor->{flags}; my $userenv = C4::Context->userenv; if ($bor->{category_type} eq "S") { - unless(C4::Auth::haspermission(undef,$userenv->{'id'},{'staffaccess'=>1})) { + unless(C4::Auth::haspermission($userenv->{'id'},{'staffaccess'=>1})) { print $input->redirect("/cgi-bin/koha/members/moremember.pl?borrowernumber=$member&error=CANT_DELETE_STAFF"); exit 1; } diff --git a/members/memberentry.pl b/members/memberentry.pl index e142e7484b..d5f04b8a36 100755 --- a/members/memberentry.pl +++ b/members/memberentry.pl @@ -141,7 +141,7 @@ if ($op eq 'insert' || $op eq 'modify' || $op eq 'save') { } } # check permission to modify login info. - if (ref($borrower_data) && ($borrower_data->{'category_type'} eq 'S') && ! (C4::Auth::haspermission($dbh,$userenv->{'id'},{'staffaccess'=>1})) ) { + if (ref($borrower_data) && ($borrower_data->{'category_type'} eq 'S') && ! (C4::Auth::haspermission($userenv->{'id'},{'staffaccess'=>1})) ) { $NoUpdateLogin = 1; } } -- 2.39.5