]> git.evergreen-ils.org Git - Evergreen.git/commit
LP#16663435 - Stripe org settings lack view permissions.
authorChris Sharp <csharp@georgialibraries.org>
Tue, 14 Feb 2017 18:27:31 +0000 (13:27 -0500)
committerDan Wells <dbw2@calvin.edu>
Thu, 16 Feb 2017 23:34:33 +0000 (18:34 -0500)
commit405eae5736e23cd8923ea567de32b1b14c442517
tree34ffc1877359b997ec111b946ca609fb9a359b8d
parent25d4b1833277e8564496396dd135aae2ef2bed72
LP#16663435 - Stripe org settings lack view permissions.

Unprivileged users can retrieve organizational unit setting values
for setting types lacking a "view" permission.  When the feature adding
Stripe credit card processing was added, the upgrade script neglected to
add the VIEW_CREDIT_CARD_PROCESSING permission to the organizational unit
setting type (which was included in 0396.data.org-setting-payflowpro.sql).

Fresh installs are not affected, but anyone who upgraded through 0863.data.stripe-payments.sql
(included in the 2.5.3-2.6.0-upgrade-db.sql version upgrade script) and is
using Stripe credit card processing should run this script.

Signed-off-by: Chris Sharp <csharp@georgialibraries.org>
Signed-off-by: Jason Stephenson <jason@sigio.com>
Signed-off-by: Galen Charlton <gmc@equinoxinitiative.org>
Open-ILS/src/sql/Pg/upgrade/XXXX.data.coust_view_perms_stripe.sql [new file with mode: 0644]