Bug 9270

Summary: Web-based SCO requires superlibrarian privileges
Product: Koha Reporter: Jared Camins-Esakov <jcamins>
Component: Self checkoutAssignee: Bugs List <koha-bugs>
Status: CLOSED WORKSFORME QA Contact:
Severity: critical    
Priority: P5 - low CC: gmcharlt
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:

Description Jared Camins-Esakov 2012-12-12 12:58:07 UTC
It would seem that the self-check user must have superlibrarian privileges, rather than the more safe-seeming circulation privileges. This is a bit of a security issue, since the cookies used on the self-checkout machine could then be modified for use with the staff client.
Comment 1 Galen Charlton 2014-05-06 15:22:15 UTC
This doesn't appear to be the case:

opac/sco/help.pl:      flagsrequired => {circulate => "circulate_remaining_permissions"},
opac/sco/sco-main.pl:    flagsrequired => { circulate => "circulate_remaining_permissions" },
opac/sco/sco-patron-image.pl:my ($query, $response) = C4::Service->init(circulate => 'circulate_remaining_permissions');

I've also tested this directly -- a normal staff user with just the circulation permission works fine.