---- Reported by drdrulm@yahoo.com 2009-04-07 17:47:44 ---- A Public Virtual Shelf can be Modified / Deleted by any non-logged in patron just like an 'Open' shelf regardless of ownership. If I log in, then the security takes over and users cannot edit shelves they don't own. When not logged in, any guest user can delete / modify any shelf. This is a new bug as far as I can see. Problem is in all browsers and makes public virtual shelves not secure because an anonymous user can change the NAME of a public virtual shelf to something else, perhaps something not so good! ---- Additional Comments From darrellulm@smfpl.org 2009-05-15 17:09:56 ---- There definitely needs to be a SYSPREF either allowing a patron to create (or not be allowed to create) PUBLIC shelves because if it is allowed, patrons can create a public shelf with *any* type of wording - i.e., think bad words! Also, there should be control over the public shelves because some libraries will want to limit this. ---- Additional Comments From drdrulm@yahoo.com 2009-07-02 15:45:26 ---- I changed the bug priory to major mainly because this nullifies the option of using the shelves. --- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:06 UTC --- This bug was previously known as _bug_ 3094 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3094 Actual time not defined. Setting to 0.0 The original reporter of this bug does not have an account here. Reassigning to the person who moved it here: chris@bigballofwax.co.nz. Previous reporter was drdrulm@yahoo.com. CC member darrellulm@smfpl.org does not have an account here
I see no way for a non-logged-in patron to edit a shelf. I also tried opening up a list edit page as a logged-in patron, logging out in another browser tab, and trying to submit the open edit page. I was told "You do not have adequate permission for that action." Can anyone reproduce this in an up-to-date installation?