---- Reported by oleonard@myacpl.org 2009-04-18 22:05:39 ---- If you copy the URL of the "send list" popup window you can change the shelfid value and send yourself any list regardless of who owns it. ---- Additional Comments From joe.atzberger@liblime.com 2009-05-28 16:04:26 ---- Note that you can see the list, but you don't know whose list it is. So there isn't as much privacy concern as there otherwise might be. --- Bug imported by chris@bigballofwax.co.nz 2010-05-21 01:06 UTC --- This bug was previously known as _bug_ 3140 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=3140 Actual time not defined. Setting to 0.0 CC member joe.atzberger@liblime.com does not have an account here
This bug still exists in master.
Created attachment 4145 [details] [review] Proposed fix for the OPAC Adding check for ShelfPossibleAction("view") to make sure the logged in user has permission to view the selected list when downloading or emailing a list.
Created attachment 4189 [details] [review] proposed fix signed-off
tested, confirmed, marking as Passed QA
Permission works, pushed please test and mark resolved
Working in master since May. Closing.