From 39da299aec91cc3f386c13ae094068e5561765b0 Mon Sep 17 00:00:00 2001
From: Demian Katz <demian.katz@villanova.edu>
Date: Wed, 8 Apr 2015 10:35:11 -0400
Subject: [PATCH] Better security on list editor.
---
module/VuFind/src/VuFind/Controller/MyResearchController.php | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/module/VuFind/src/VuFind/Controller/MyResearchController.php b/module/VuFind/src/VuFind/Controller/MyResearchController.php
index 30ba1c8a564..4f572a3bc05 100644
--- a/module/VuFind/src/VuFind/Controller/MyResearchController.php
+++ b/module/VuFind/src/VuFind/Controller/MyResearchController.php
@@ -749,6 +749,11 @@ class MyResearchController extends AbstractBase
$newList = ($id == 'NEW');
$list = $newList ? $table->getNew($user) : $table->getExisting($id);
+ // Make sure the user isn't fishing for other people's lists:
+ if (!$newList && !$list->editAllowed($user)) {
+ throw new ListPermissionException('Access denied.');
+ }
+
// Process form submission:
if ($this->formWasSubmitted('submit')) {
if ($redirect = $this->processEditList($user, $list)) {
--
GitLab