Bug 17316

Summary: Possible to see name of lists you don't own
Product: Koha Reporter: Katrin Fischer <katrin.fischer>
Component: ListsAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: f.demians, jonathan.druart, julian.maurice, kyle, m.de.rooy, veron
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 14544    
Bug Blocks:    
Attachments: Bug 17316: Do not display the list's name if the user does not have permission
Bug 17316: Do not display the list's name if the user does not have permission - Staff
Bug 17316: Do not display the list's name if the user does not have permission - OPAC
Bug 17316: Do not display the list's name if the user does not have permission - Staff
Bug 17316: Do not display the list's name if the user does not have permission - OPAC
Bug 17316: Do not display the list's name if the user does not have permission - Staff
[PASSED QA] Bug 17316: Do not display the list's name if the user does not have permission - OPAC
[PASSED QA] Bug 17316: Do not display the list's name if the user does not have permission - Staff

Description Katrin Fischer 2016-09-18 19:40:27 UTC
When you try to access a list you haven't created/you are not the owner of by manipulating the URL, you can't see the entries, but you can see the name of the list:

../cgi-bin/koha/opac-shelves.pl?op=view&shelfnumber=1&sortfield=title
Comment 1 Marc Véron 2016-09-19 08:13:38 UTC
Confirmed.
Name of list is visible in breadcrumbs as well...
Comment 2 Jonathan Druart 2016-09-20 08:58:52 UTC
Created attachment 55707 [details] [review]
Bug 17316: Do not display the list's name if the user does not have permission

At the OPAC, if a user manipulate the URL to show a list (s)he is not
allowed to view, the list's name will be displayed anyway.

Test plan:
- Create a private list with user A
- Copy the op=view URL and access it with user B logged in
=> Without this patch, you will see the rss icon, the list's name and
the "add list" button
=> Without this patch, only the "unauthorized" box will be displayed
Comment 3 Jonathan Druart 2016-09-20 09:01:11 UTC
Same problem on the staff interface.
Comment 4 Jonathan Druart 2016-09-20 09:05:15 UTC
Created attachment 55708 [details] [review]
Bug 17316: Do not display the list's name if the user does not have permission - Staff

Same as previous patch but for the staff interface
Comment 5 Jonathan Druart 2016-09-20 09:05:37 UTC
Created attachment 55709 [details] [review]
Bug 17316: Do not display the list's name if the user does not have permission - OPAC

At the OPAC, if a user manipulate the URL to show a list (s)he is not
allowed to view, the list's name will be displayed anyway.

Test plan:
- Create a private list with user A
- Copy the op=view URL and access it with user B logged in
=> Without this patch, you will see the rss icon, the list's name and
the "add list" button
=> Without this patch, only the "unauthorized" box will be displayed
Comment 6 Jonathan Druart 2016-09-20 09:05:40 UTC
Created attachment 55710 [details] [review]
Bug 17316: Do not display the list's name if the user does not have permission - Staff

Same as previous patch but for the staff interface
Comment 7 Marc Véron 2016-09-20 09:17:21 UTC
Created attachment 55711 [details] [review]
Bug 17316: Do not display the list's name if the user does not have permission - OPAC

At the OPAC, if a user manipulate the URL to show a list (s)he is not
allowed to view, the list's name will be displayed anyway.

Test plan:
- Create a private list with user A
- Copy the op=view URL and access it with user B logged in
=> Without this patch, you will see the rss icon, the list's name and
the "add list" button
=> Without this patch, only the "unauthorized" box will be displayed

Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>
Comment 8 Marc Véron 2016-09-20 09:19:37 UTC
Created attachment 55712 [details] [review]
Bug 17316: Do not display the list's name if the user does not have permission - Staff

Same as previous patch but for the staff interface

Signed-off-by: Marc Véron <veron@veron.ch>
Comment 9 Katrin Fischer 2016-09-25 16:31:02 UTC
Much better, thx for fixing!
Comment 10 Katrin Fischer 2016-09-25 16:32:08 UTC
Created attachment 55802 [details] [review]
[PASSED QA] Bug 17316: Do not display the list's name if the user does not have permission - OPAC

At the OPAC, if a user manipulate the URL to show a list (s)he is not
allowed to view, the list's name will be displayed anyway.

Test plan:
- Create a private list with user A
- Copy the op=view URL and access it with user B logged in
=> Without this patch, you will see the rss icon, the list's name and
the "add list" button
=> Without this patch, only the "unauthorized" box will be displayed

Followed test plan, works as expected.
Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer  <katrin.fischer@bsz-bw.de>
Comment 11 Katrin Fischer 2016-09-25 16:33:23 UTC
Created attachment 55803 [details] [review]
[PASSED QA] Bug 17316: Do not display the list's name if the user does not have permission - Staff

Same as previous patch but for the staff interface

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Katrin Fischer  <katrin.fischer@bsz-bw.de>
Comment 12 Kyle M Hall 2016-09-27 10:37:25 UTC
Pushed to master for 16.11, thanks Jonathan!
Comment 13 Frédéric Demians 2016-09-30 08:12:01 UTC
Pushed in 16.05. Will be in 16.05.05.
Comment 14 Julian Maurice 2016-10-14 10:30:35 UTC
Pushed to 3.22.x, will be in 3.22.12