https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43980
Bug ID: 43980
Summary: C4::Auth::_dispatch crashes (500) on hash (AND)
permission when user lacks the module
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: Main
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P5 - low
Component: Authentication
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected]
Target Milestone: ---
I noticed while doing this
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41869 bug that AND
permissions are not handled correctly.
Route permission (swagger):
x-koha-authorization:
permissions:
reserveforothers:
place_holds: 1
modify_holds_priority: 1
- Patron with both permissions → 200 OK
- Patron with only place_holds → 403 Forbidden
- Patron with no reserveforothers permission at all → 500 Internal Server Error
(should be 403)
`C4::Auth::_dispatch` mishandles a hash (AND) permission requirement when the
user has no permission for that module at all.
In the HASH branch:
foreach my $key ( keys %{$required} ) {
next if $flags == 1;
my $rflags = $flags->{$key};
return 0 unless _dispatch( $require, $rflags );
}
a user without the module has `$flags == 0` (integer), so `$flags->{$key}`
tries to use `0` as a hash ref and throws, producing a 500 instead of 403.
--
You are receiving this mail because:
You are watching all bug changes.
You are the assignee for the bug.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
