From e524c68ffba4cc7fb342b280409c810cec4b259f Mon Sep 17 00:00:00 2001 From: Jason Stephenson Date: Mon, 11 Jun 2012 16:12:54 -0400 Subject: [PATCH] Security fix for Launchpad Bug 1003052. Bug reported by James Fournie: Revoking the UPDATE_MARC permission doesn't actually seem to prevent a user from editing a record. Our use case is that we would like a user to create new records but not edit existing MARC records. Changing CREATE_MARC to UPDATE_MARC in OpenILS::Application::Cat's biblio_record_replace_marc() method seems to fix the problem. Signed-off-by: Jason Stephenson Signed-off-by: Lebbeous Fogle-Weekley --- Open-ILS/src/perlmods/lib/OpenILS/Application/Cat.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Open-ILS/src/perlmods/lib/OpenILS/Application/Cat.pm b/Open-ILS/src/perlmods/lib/OpenILS/Application/Cat.pm index a442aff233..b9b79bee32 100644 --- a/Open-ILS/src/perlmods/lib/OpenILS/Application/Cat.pm +++ b/Open-ILS/src/perlmods/lib/OpenILS/Application/Cat.pm @@ -159,7 +159,7 @@ sub biblio_record_replace_marc { my( $self, $conn, $auth, $recid, $newxml, $source, $oargs ) = @_; my $e = new_editor(authtoken=>$auth, xact=>1); return $e->die_event unless $e->checkauth; - return $e->die_event unless $e->allowed('CREATE_MARC', $e->requestor->ws_ou); + return $e->die_event unless $e->allowed('UPDATE_MARC', $e->requestor->ws_ou); my $fix_tcn = $self->api_name =~ /replace/o; if($self->api_name =~ /override/o) { -- 2.43.2