From 3a0f1cc7b2efa517ee4cd4c6a682237554fed307 Mon Sep 17 00:00:00 2001 From: Jason Stephenson Date: Wed, 18 Feb 2015 16:28:31 -0500 Subject: [PATCH] LP#1424755: Org Unit Setting view permissions can be bypassed Fix private org. unit setting leakage by forcing the $auth argument to true if not passed in when open-ils.actor.ou_setting.ancestor_default or open-ils.actor.ou_setting.ancestor_default.batch are called. Other than a change to the desc of the public methods to reflect that they now check permissions if permissions are required, there are no required api changes to the back or the front ends. Signed-off-by: Jason Stephenson Signed-off-by: Galen Charlton Signed-off-by: Ben Shum --- .../src/perlmods/lib/OpenILS/Application/Actor.pm | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/Open-ILS/src/perlmods/lib/OpenILS/Application/Actor.pm b/Open-ILS/src/perlmods/lib/OpenILS/Application/Actor.pm index 4e3df185bf..8c97669444 100644 --- a/Open-ILS/src/perlmods/lib/OpenILS/Application/Actor.pm +++ b/Open-ILS/src/perlmods/lib/OpenILS/Application/Actor.pm @@ -269,8 +269,9 @@ __PACKAGE__->register_method( method => 'ou_ancestor_setting', signature => { desc => 'Get the org unit setting value associated with the setting name as seen from the specified org unit. ' . - 'IF AND ONLY IF an authentication token is provided, this method will make sure that the given ' . - 'user has permission to view that setting, if there is a permission associated with the setting.' , + 'This method will make sure that the given user has permission to view that setting, if there is a ' . + 'permission associated with the setting. If a permission is required and no authtoken is given, or ' . + 'the user lacks the permisssion, undef will be returned.' , params => [ { desc => 'Org unit ID', type => 'number' }, { desc => 'setting name', type => 'string' }, @@ -289,6 +290,8 @@ __PACKAGE__->register_method( # ------------------------------------------------------------------ sub ou_ancestor_setting { my( $self, $client, $orgid, $name, $auth ) = @_; + # Make sure $auth is set to something if not given. + $auth ||= -1; return $U->ou_ancestor_setting($orgid, $name, undef, $auth); } @@ -297,8 +300,9 @@ __PACKAGE__->register_method( method => 'ou_ancestor_setting_batch', signature => { desc => 'Get org unit setting name => value pairs for a list of names, as seen from the specified org unit. ' . - 'IF AND ONLY IF an authentication token is provided, this method will make sure that the given ' . - 'user has permission to view that setting, if there is a permission associated with the setting.' , + 'This method will make sure that the given user has permission to view that setting, if there is a ' . + 'permission associated with the setting. If a permission is required and no authtoken is given, or ' . + 'the user lacks the permisssion, undef will be returned.' , params => [ { desc => 'Org unit ID', type => 'number' }, { desc => 'setting name list', type => 'array' }, @@ -309,6 +313,8 @@ __PACKAGE__->register_method( ); sub ou_ancestor_setting_batch { my( $self, $client, $orgid, $name_list, $auth ) = @_; + # Make sure $auth is set to something if not given. + $auth ||= -1; my %values; $values{$_} = $U->ou_ancestor_setting($orgid, $_, undef, $auth) for @$name_list; return \%values; -- 2.43.2