https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33260
--- Comment #423 from Martin Renvoize (ashimema) <[email protected]> --- Created attachment 209078 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209078&action=edit Bug 33260: (QA follow-up) Secure and fix the notices management pages Printing: * members/print_notice.pl looked messages up by id without any check, so a staff member who can only see the patrons of some libraries could print the notice of any patron by guessing an id, and an unknown id gave a 500. Look the messages up with search_limited, ignore ids that are not numeric, unknown or not allowed, and honour the NoticesManagement preference. * Displaying notices no longer changes them. Marking them as sent now needs a POST with a CSRF token and the 'cud-print' operation: the per-row and modal "Print" buttons submit a form like the bulk "Print selected notices" already did. This also makes the modal Print consistent with the banner, which says printing marks the notice as sent. * The notice content in the list pages and the modal preview is shown in sandboxed frames instead of being injected into the staff page, so nothing in a notice can run in the staff session. * print_notice.tt outputs AllNoticeStylesheet, says when there is nothing to print and does not start printing then. tools/notices.pl: * Stop after redirecting when NoticesManagement is off. * The 'To' date is inclusive, dates are parsed with dt_from_string and invalid ones are ignored. * Use the modules it uses, drop unused code, https licence URL. Templates: * The status filter always selected 'sent' whatever the search. * The patron page sorted on the wrong column since a column was added, showed the notice frames and applied 'NoSort', which kohaTable does not know ('no-sort'). The tools table now uses kohaTable. * Show the print controls of the patron page only to staff who can use print_notice.pl, and the resend control of the tools page only to staff who can use members/notices.pl. * Use the patron of the notice in delivery notes, __() in JavaScript. members/notices.pl: resending compared the message's patron with an assignment (=), so any message id could be resent from any patron's page. To test: 1. Enable NoticesManagement and queue notices for patrons of at least two libraries (for example by placing holds, or from the staff interface with Notices and slips). 2. Tools > Notices management lists the notices. Search with a status and confirm the status stays selected, and with the same date in From and To confirm notices queued that day are listed. 3. Click Print on a notice. A new tab shows the notice, and it is now 'sent'. Open the notice and click Print in the window, same result. 4. Select several notices and click "Print selected notices", the same. 5. Open the URL /cgi-bin/koha/members/print_notice.pl?message_ids=ID of a pending notice directly. The notice is shown but stays pending, and unknown ids (...message_ids=99999) do not give an error. 6. Create a staff member with only the Tools > view_generated_notices permission, in a library group that hides patron information from other libraries. Log in as them: only the notices of patrons of their libraries are listed, and print_notice.pl does not show the notice of a patron of another library when you use its id. 7. Disable NoticesManagement: tools/notices.pl and print_notice.pl go back to Tools home. 8. On a patron's Notices tab confirm the default sort is by 'Time created', and that no notice content is displayed in the table. 9. Sign off Co-Authored-By: Claude Sonnet 5.5 <[email protected]> -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
